{"id":"CVE-2026-124279","kind":"vulnerability","aliases":["CVE-2026-124279"],"related":[],"title":"elixir-grpc: unauthenticated streaming requests can exhaust server memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\n\nThe streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0.","summary":"The grpc_server Elixir library buffers client-streaming and bidirectional-streaming gRPC messages before checking the size limit, and releases before 1.0.6 apply no limit to streaming at all. An unauthenticated attacker can open many concurrent streams and exhaust the memory of the server node.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","grpc","grpc_server","hex","package"],"not_affected_if":["auth-required","no-grpc-server","unary-only"],"how_to_check":"- Check the `grpc_server` version in `mix.lock` or `mix.exs`; versions from `1.0.0` before `1.1.0` are affected.\n- Look for streaming RPCs (client-streaming or bidirectional) served through `GRPC.Server.Adapters.Cowboy`.\n- Check whether `max_body_size` is set in the server configuration.","fix":"- `grpc_server`: move to `1.1.0` or later (the sources state the affected range is from `1.0.0` before `1.1.0`; releases before `1.0.6` had no streaming limit at all).","status":"open","published_at":"2026-11-13T17:17:20+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","triaged_at":"2026-11-13T17:48:46+00:00","updated_at":"2026-11-13T17:48:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T17:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- `grpc_server`: move to `1.1.0` or later (the sources state the affected range is from `1.0.0` before `1.1.0`; releases before `1.0.6` had no streaming limit at all).","reach":"internet","title":"elixir-grpc: unauthenticated streaming requests can exhaust server memory","impact":"medium","summary":"The grpc_server Elixir library buffers client-streaming and bidirectional-streaming gRPC messages before checking the size limit, and releases before 1.0.6 apply no limit to streaming at all. An unauthenticated attacker can open many concurrent streams and exhaust the memory of the server node.","audience":"developers","category":"package","nicknames":[],"who_cares":["elixir","grpc","grpc_server","hex"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated clients exhaust node memory and crash the service","analyst_note":"","how_to_check":"- Check the `grpc_server` version in `mix.lock` or `mix.exs`; versions from `1.0.0` before `1.1.0` are affected.\n- Look for streaming RPCs (client-streaming or bidirectional) served through `GRPC.Server.Adapters.Cowboy`.\n- Check whether `max_body_size` is set in the server configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["unary-only","no-grpc-server","auth-required"],"who_is_affected":"Teams running Elixir services that use the grpc_server library with streaming gRPC endpoints exposed to clients. Services that only use unary RPCs or sit behind an authenticating gateway that caps request size are less exposed. Teams not using grpc_server or the Cowboy adapter can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000813,"input_tokens":4806,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124279':13A,16A '-2026':12A,15A '/3':107C '000':116C,117C '1.0.0':192C '1.0.6':46B,177C '1.1.0':194C '8':115C 'affect':188C 'alloc':70C 'allow':84C 'appli':47B,178C 'ask':110C 'attack':56B,86C 'beyond':160C 'bidirect':34B,97C 'bidirectional-stream':33B,96C 'bodi':128C 'buffer':28B,149C,154C 'byte':118C 'check':39B,144C 'claus':103C 'client':30B,93C 'client-stream':29B,92C 'compar':122C 'concurr':60B,170C 'configur':162C 'cowboy':111C 'cve':11A,14A 'elixir':2A,17B,26B,80C 'elixir-grpc':1A,79C 'exhaust':8A,63B,88C,172C 'full':158C 'grpc':3A,18B,19B,24B,36B,81C,82C,108C,136C,189C 'grpc.server.adapters.cowboy.handler.info':106C 'grpc.server.adapters.cowboy.handler.info/3':105C 'hex':21B 'issu':187C 'length':137C 'librari':27B 'limit':42B,49B,74C,163C,180C 'mani':59B,169C 'max':127C 'memori':10A,65B,90C,174C 'messag':37B,141C,147C 'node':69B,173C 'one':157C 'open':58B 'packag':22B 'per':119C 'prefix':138C 'read':102C,120C,133C,159C 'refus':167C 'releas':44B,175C 'request':6A,99C,183C 'resourc':72C 'return':134C 'run':124C 'server':9A,20B,25B,68B,83C,89C,190C 'server/lib/grpc/server/adapters/cowboy/handler.ex':109C 'size':41B,129C 'stream':5A,31B,35B,51B,61B,94C,98C,101C,151C,171C,182C 'therefor':153C 'throttl':76C 'total':125C 'unauthent':4A,55B,85C 'via':91C 'vulner':77C 'without':73C","nicknames":[],"mitigations":[],"who_affected":"Teams running Elixir services that use the grpc_server library with streaming gRPC endpoints exposed to clients. Services that only use unary RPCs or sit behind an authenticating gateway that caps request size are less exposed. Teams not using grpc_server or the Cowboy adapter can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elixir","grpc","grpcserver","hex","high","package"],"campaign_type":null,"search_a":"'-124279':13A,16A '-2026':12A,15A 'cve':11A,14A 'elixir':2A 'elixir-grpc':1A 'exhaust':8A 'grpc':3A 'memori':10A 'request':6A 'server':9A 'stream':5A 'unauthent':4A","search_b":"'1.0.6':46B 'appli':47B 'attack':56B 'bidirect':34B 'bidirectional-stream':33B 'buffer':28B 'check':39B 'client':30B 'client-stream':29B 'concurr':60B 'elixir':17B,26B 'exhaust':63B 'grpc':18B,19B,24B,36B 'hex':21B 'librari':27B 'limit':42B,49B 'mani':59B 'memori':65B 'messag':37B 'node':69B 'open':58B 'packag':22B 'releas':44B 'server':20B,25B,68B 'size':41B 'stream':31B,35B,51B,61B 'unauthent':55B","search_c":"'/3':107C '000':116C,117C '1.0.0':192C '1.0.6':177C '1.1.0':194C '8':115C 'affect':188C 'alloc':70C 'allow':84C 'appli':178C 'ask':110C 'attack':86C 'beyond':160C 'bidirect':97C 'bidirectional-stream':96C 'bodi':128C 'buffer':149C,154C 'byte':118C 'check':144C 'claus':103C 'client':93C 'client-stream':92C 'compar':122C 'concurr':170C 'configur':162C 'cowboy':111C 'elixir':80C 'elixir-grpc':79C 'exhaust':88C,172C 'full':158C 'grpc':81C,82C,108C,136C,189C 'grpc.server.adapters.cowboy.handler.info':106C 'grpc.server.adapters.cowboy.handler.info/3':105C 'issu':187C 'length':137C 'limit':74C,163C,180C 'mani':169C 'max':127C 'memori':90C,174C 'messag':141C,147C 'node':173C 'one':157C 'per':119C 'prefix':138C 'read':102C,120C,133C,159C 'refus':167C 'releas':175C 'request':99C,183C 'resourc':72C 'return':134C 'run':124C 'server':83C,89C,190C 'server/lib/grpc/server/adapters/cowboy/handler.ex':109C 'size':129C 'stream':94C,98C,101C,151C,171C,182C 'therefor':153C 'throttl':76C 'total':125C 'unauthent':85C 'via':91C 'vulner':77C 'without':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:27:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124279","severity":null,"published_at":"2026-11-13T17:17:20+00:00","modified_at":"2026-11-13T17:17:20+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","fetched_at":"2026-11-13T17:48:00+00:00","note":null}],"documents":[{"id":90338,"url":"https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148072,"url":"https://github.com/elixir-grpc/grpc/commit/b1e771d558941b1ed4b6de8b39f6a5375543db01","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148073,"url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-736x-r87j-jhcm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-13T15:27:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}