{"uuid": "878685fe-007a-4674-b551-0cbcbc6751a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6ccx-9c9f-327w", "type": "seen", "source": "https://gist.github.com/alon710/54b5d53eeeb09b8b5b899def091e09f5", "content": "# CVE-2026-53430: CVE-2026-53430: Unauthenticated Remote Denial of Service via Gzip Decompression Bomb in elixir-grpc/grpc\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53430\n\n## Summary\nCVE-2026-53430 is a critical uncontrolled resource consumption vulnerability in the elixir-grpc/grpc library. An unauthenticated remote attacker can cause immediate memory exhaustion and system crashes by sending crafted gRPC frames compressed with Gzip, leading to a complete Denial of Service.\n\n## TL;DR\nUnauthenticated remote attackers can crash Elixir-based gRPC servers by sending a small, highly compressed Gzip payload that expands to multiple gigabytes, triggering an Out-Of-Memory crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409\n- **Attack Vector**: Network\n- **CVSS 4.0 Score**: 8.7\n- **EPSS Score**: 0.00348 (0.35% exploitation probability)\n- **Impact**: Complete Denial of Service (OOM Crash)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc (Hex package 'grpc')\n- **grpc**: >= 0.4.0, < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade the elixir-grpc dependency to version 1.0.0 or higher.\n- Transition monolithic :grpc dependency configurations to use the modular :grpc_server package.\n- Apply restrictive request body size limits at the ingress load balancer or reverse proxy layer.\n- Limit concurrent HTTP/2 streams per connection to prevent parallel decompression attacks.\n\n**Remediation Steps:**\n1. Locate the mix.exs configuration file within the Elixir application.\n2. Update the gRPC dependency declarations to target the secure v1.0 releases, using the :grpc_server package.\n3. In corporate configuration files (e.g., config/config.exs), explicitly define the `:max_decompressed_message_length` parameter to enforce strict limits.\n4. Deploy the updated codebase to staging environments and execute unit tests containing compression payloads to verify safe termination.\n\n## References\n\n- [Official Erlef Advisory Page](https://cna.erlef.org/cves/CVE-2026-53430.html)\n- [GitHub Security Advisory (GHSA-6ccx-9c9f-327w)](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w)\n- [Official Fix Commit](https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc)\n- [OSV Vulnerability Entry](https://osv.dev/vulnerability/EEF-CVE-2026-53430)\n- [MITRE CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-53430)\n- [NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-53430)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53430) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T08:31:40.829312Z"}