CVE-2026-121809 · Package
NO FIX YET · SEE WHAT TO DO
A client-streaming or bidirectional gRPC request whose body ends partway through a message makes the Cowboy adapter retry a read forever. Each such request pins one Erlang/BEAM scheduler for as long as the connection stays open, so repeated requests can stall the server.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Elixir services that run the grpc_server or grpc packages with the Cowboy adapter and expose client-streaming or bidirectional-streaming RPCs are exposed. The request needs no authentication, so any client that can reach the endpoint can trigger it. Services that only use unary RPCs or do not run the Cowboy adapter are not affected by the described path.
Not affected if no-streaming-rpcs, unary-only
Who cares beam, cowboy, elixir, grpc
grpc_server (from 1.0.0 before 1.1.0) or grpc (from 0.3.1 before 1.0.0) in mix.lock.grpc_server: move to 1.1.0 or later.grpc: move to 1.0.0 or later.Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.
GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.