CVE-2026-124279 · Package
NO FIX YET · SEE WHAT TO DO
The grpc_server Elixir library buffers client-streaming and bidirectional-streaming gRPC messages before checking the size limit, and releases before 1.0.6 apply no limit to streaming at all. An unauthenticated attacker can open many concurrent streams and exhaust the memory of the server node.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Elixir services that use the grpc_server library with streaming gRPC endpoints exposed to clients. Services that only use unary RPCs or sit behind an authenticating gateway that caps request size are less exposed. Teams not using grpc_server or the Cowboy adapter can skip it.
Not affected if auth-required, no-grpc-server, unary-only
Who cares elixir, grpc, grpc_server, hex
grpc_server version in mix.lock or mix.exs; versions from 1.0.0 before 1.1.0 are affected.GRPC.Server.Adapters.Cowboy.max_body_size is set in the server configuration.grpc_server: move to or later (the sources state the affected range is from before ; releases before had no streaming limit at all).Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.
The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.
This issue affects grpc_server: from 1.0.0 before 1.1.0.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.1.01.0.01.1.01.0.6This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.