CVE-2026-121808 · Package
NO FIX YET · SEE WHAT TO DO
The Erlpack codec in elixir-grpc decodes message bodies with binary_to_term, which fully inflates a compressed term with no size limit, while the body size limit counts only the compressed bytes. An unauthenticated attacker can send a small request that makes the server allocate far more memory than the request size, exhausting it.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers built with elixir-grpc that accept gRPC requests using the Erlpack content type are exposed, since the decoder runs on any incoming message body before type checks. Applications that only use other codecs, or that do not expose gRPC to untrusted clients, can skip this.
Not affected if no-untrusted-grpc-clients, other-codecs-only
Who cares elixir, erlang, grpc, self-hosted
grpc version in mix.lock or mix.exs; affected if it is from 0.4.0 before 1.0.0.grpc_core version in mix.lock; affected if it is from 1.0.0 before 1.1.0.application/grpc+erlpack requests (the GRPC.Codec.Erlpack codec is in use).Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.
GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.
This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
grpc_core (1.0.0 to before 1.1.0): upgrade to 1.1.0.grpc: fixed version unknown from the sources; the affected range ends at 1.0.0.This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.