---
id: "CVE-2026-124279"
page: "https://infrastack.ai/live/CVE-2026-124279"
kind: "vulnerability"
aliases: ["CVE-2026-124279"]
title: "elixir-grpc: unauthenticated streaming requests can exhaust server memory"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "grpc", "grpc_server", "hex", "package"]
not_affected_if: ["auth-required", "no-grpc-server", "unary-only"]
published_at: "2026-11-13T17:17:20+00:00"
first_seen_at: "2026-11-13T17:48:00+00:00"
updated_at: "2026-11-13T17:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124279", "first_seen_at": "2026-11-13T17:48:00+00:00"}]
exploit_sources: []
---

# elixir-grpc: unauthenticated streaming requests can exhaust server memory

Link for people: https://infrastack.ai/live/CVE-2026-124279 (this .md is for agents)

The grpc_server Elixir library buffers client-streaming and bidirectional-streaming gRPC messages before checking the size limit, and releases before 1.0.6 apply no limit to streaming at all. An unauthenticated attacker can open many concurrent streams and exhaust the memory of the server node.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the `grpc_server` version in `mix.lock` or `mix.exs`; versions from `1.0.0` before `1.1.0` are affected.
- Look for streaming RPCs (client-streaming or bidirectional) served through `GRPC.Server.Adapters.Cowboy`.
- Check whether `max_body_size` is set in the server configuration.

## Fix

- `grpc_server`: move to `1.1.0` or later (the sources state the affected range is from `1.0.0` before `1.1.0`; releases before `1.0.6` had no streaming limit at all).

## Timeline

- 2026-11-13T17:48:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124279

## Documents

- [advisory] Vendor advisory: github.com https://github.com/elixir-grpc/grpc/security/advisories/GHSA-736x-r87j-jhcm
- [fix] Patch: github.com https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00
- [fix] Patch: github.com https://github.com/elixir-grpc/grpc/commit/b1e771d558941b1ed4b6de8b39f6a5375543db01

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.

The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.

This issue affects grpc_server: from 1.0.0 before 1.1.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_