CVE-2026-121809 (GCVE-0-2026-121809)
Vulnerability from cvelistv5 – Published: 2026-11-13 16:18 – Updated: 2026-11-13 19:32
VLAI
EPSS
VEX
Title
CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server
Summary
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.
GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:55 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/elixir-grpc/grpc/security/advi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-121809.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-121809 | related |
| https://github.com/elixir-grpc/grpc/commit/0332fa… | related |
| https://github.com/elixir-grpc/grpc/commit/38955f… | patch |
| https://github.com/elixir-grpc/grpc/commit/6d8a09… | related |
Impacted products
4 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| elixir-grpc | grpc_server |
Affected:
1.0.0 , < 1.1.0
(semver)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
||
| elixir-grpc | grpc_server |
Affected:
0332faae5f5e132314794dbfdae5edecbccea292 , < 38955f1392cbf08eef231a347348445410455c85
(git)
cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* |
||
| elixir-grpc | grpc |
Affected:
0.3.1 , < 1.0.0
(semver)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
||
| elixir-grpc | grpc |
Affected:
6d8a09ad919e208fb600538ac8b19bd733a04310 , < 0332faae5f5e132314794dbfdae5edecbccea292
(git)
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:55:12.226355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T19:32:40.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "38955f1392cbf08eef231a347348445410455c85",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "6d8a09ad919e208fb600538ac8b19bd733a04310",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe server must expose at least one client-streaming or bidirectional-streaming RPC method.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Adam Jordan"
},
{
"lang": "en",
"type": "finder",
"value": "Adam Jordan"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Marko Vejnovic"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Paulo Valente"
},
{
"lang": "en",
"type": "coordinator",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-13T11:19:46.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLoop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eGRPC.Server.Adapters.Cowboy.read_stream/1\u003c/code\u003e (\u003ccode\u003egrpc_server/lib/grpc/server/adapters/cowboy.ex\u003c/code\u003e, and the Cowboy adapter in \u003ccode\u003egrpc\u003c/code\u003e before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with \u003ccode\u003eEND_STREAM\u003c/code\u003e keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\u003c/p\u003e\n\u003cp\u003eThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\n`GRPC.Server.Adapters.Cowboy.read_stream/1` (`grpc_server/lib/grpc/server/adapters/cowboy.ex`, and the Cowboy adapter in `grpc` before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with `END_STREAM` keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."
}
],
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\nGRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."
}
],
"value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:18:37.954Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-c2h9-f9cc-27xh"
},
{
"name": "EEF CNA record for CVE-2026-121809",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-121809.html"
},
{
"name": "OSV record EEF-CVE-2026-121809",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-121809"
},
{
"name": "Introducing commit 0332faa in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"name": "Fix commit 38955f1 in elixir-grpc/grpc",
"tags": [
"patch"
],
"url": "https://github.com/elixir-grpc/grpc/commit/38955f1392cbf08eef231a347348445410455c85"
},
{
"name": "Introducing commit 6d8a09a in elixir-grpc/grpc",
"tags": [
"related"
],
"url": "https://github.com/elixir-grpc/grpc/commit/6d8a09ad919e208fb600538ac8b19bd733a04310"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a server that exposes a client-streaming RPC, for example \u003ccode\u003eRouteGuide.RecordRoute\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOpen an HTTP/2 connection and send \u003ccode\u003eHEADERS\u003c/code\u003e for that method with \u003ccode\u003econtent-type: application/grpc\u003c/code\u003e and no \u003ccode\u003egrpc-timeout\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend one \u003ccode\u003eDATA\u003c/code\u003e frame with \u003ccode\u003eEND_STREAM\u003c/code\u003e that holds only the 5-byte prefix \u003ccode\u003e00 00 00 00 64\u003c/code\u003e, which declares a 100-byte message.\u003c/li\u003e\n\u003cli\u003eKeep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a server that exposes a client-streaming RPC, for example `RouteGuide.RecordRoute`.\n2. Open an HTTP/2 connection and send `HEADERS` for that method with `content-type: application/grpc` and no `grpc-timeout`.\n3. Send one `DATA` frame with `END_STREAM` that holds only the 5-byte prefix `00 00 00 00 64`, which declares a 100-byte message.\n4. Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."
}
],
"value": "* Start a server that exposes a client-streaming RPC, for example RouteGuide.RecordRoute.\n* Open an HTTP/2 connection and send HEADERS for that method with content-type: application/grpc and no grpc-timeout.\n* Send one DATA frame with END_STREAM that holds only the 5-byte prefix 00 00 00 00 64, which declares a 100-byte message.\n* Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. A partial message\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with \u003ccode\u003eEND_STREAM\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. The reader asks for more\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eread_stream/1\u003c/code\u003e calls \u003ccode\u003eGRPC.Message.get_message/1\u003c/code\u003e, which returns \u003ccode\u003efalse\u003c/code\u003e because the declared message is incomplete. \u003ccode\u003eread_stream/1\u003c/code\u003e then sets \u003ccode\u003eneed_more\u003c/code\u003e and reads again through \u003ccode\u003eHandler.read_body/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Every read is empty\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eOnce the body has been read, the handler\u0027s \u003ccode\u003easync_read_body/2\u003c/code\u003e (and \u003ccode\u003ecowboy_req:read_body/2\u003c/code\u003e in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. No timeout ends it\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a \u003ccode\u003egrpc-timeout\u003c/code\u003e header there is no deadline, and the adapter\u0027s idle timeout defaults to \u003ccode\u003e:infinity\u003c/code\u003e. One scheduler stays at full load until the client closes the connection.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. A partial message**\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with `END_STREAM`.\n\n**2. The reader asks for more**\n\n`read_stream/1` calls `GRPC.Message.get_message/1`, which returns `false` because the declared message is incomplete. `read_stream/1` then sets `need_more` and reads again through `Handler.read_body/1`.\n\n**3. Every read is empty**\n\nOnce the body has been read, the handler\u0027s `async_read_body/2` (and `cowboy_req:read_body/2` in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n**4. No timeout ends it**\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a `grpc-timeout` header there is no deadline, and the adapter\u0027s idle timeout defaults to `:infinity`. One scheduler stays at full load until the client closes the connection."
}
],
"value": "1. A partial message\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with END_STREAM.\n\n2. The reader asks for more\n\nread_stream/1 calls GRPC.Message.get_message/1, which returns false because the declared message is incomplete. read_stream/1 then sets need_more and reads again through Handler.read_body/1.\n\n3. Every read is empty\n\nOnce the body has been read, the handler\u0027s async_read_body/2 (and cowboy_req:read_body/2 in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n4. No timeout ends it\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a grpc-timeout header there is no deadline, and the adapter\u0027s idle timeout defaults to :infinity. One scheduler stays at full load until the client closes the connection."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-121809",
"datePublished": "2026-11-13T16:18:37.954Z",
"dateReserved": "2026-11-13T11:19:13.834Z",
"dateUpdated": "2026-11-13T19:32:40.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc_server",
"packageURL": "pkg:hex/grpc_server",
"product": "grpc_server",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc_server",
"programFiles": [
"grpc_server/lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "38955f1392cbf08eef231a347348445410455c85",
"status": "affected",
"version": "0332faae5f5e132314794dbfdae5edecbccea292",
"versionType": "git"
}
]
},
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "grpc",
"packageURL": "pkg:hex/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027"
],
"packageName": "elixir-grpc/grpc",
"packageURL": "pkg:github/elixir-grpc/grpc",
"product": "grpc",
"programFiles": [
"lib/grpc/server/adapters/cowboy.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:reading_stream/1"
},
{
"name": "\u0027Elixir.GRPC.Server.Adapters.Cowboy\u0027:read_stream/1"
}
],
"repo": "https://github.com/elixir-grpc/grpc",
"vendor": "elixir-grpc",
"versions": [
{
"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292",
"status": "affected",
"version": "6d8a09ad919e208fb600538ac8b19bd733a04310",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\nGRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."
}
],
"id": "CVE-2026-121809",
"lastModified": "2026-11-13T20:18:11.570",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-121809",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:55:12.226355Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-11-13T17:17:19.310",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-121809.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-grpc/grpc/commit/38955f1392cbf08eef231a347348445410455c85"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-grpc/grpc/commit/6d8a09ad919e208fb600538ac8b19bd733a04310"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-c2h9-f9cc-27xh"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-121809"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Received",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
},
{
"lang": "en",
"value": "CWE-835"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
}
}
}
Configurations
CNA · EEF
The server must expose at least one client-streaming or bidirectional-streaming RPC method.
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.