---
id: "CVE-2026-71397"
page: "https://infrastack.ai/live/CVE-2026-71397"
kind: "vulnerability"
aliases: ["CVE-2026-71397"]
title: "elixir-grpc: unlimited streaming buffers let unauthenticated clients exhaust memory"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cowboy", "elixir", "grpc", "grpc_server", "package"]
not_affected_if: ["not-internet-facing", "unary-only-rpcs", "version-1.0.6-or-later"]
published_at: "2026-11-06T21:17:10+00:00"
first_seen_at: "2026-11-06T21:45:08+00:00"
updated_at: "2026-11-06T21:46:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71397", "first_seen_at": "2026-11-06T21:45:08+00:00"}]
exploit_sources: []
---

# elixir-grpc: unlimited streaming buffers let unauthenticated clients exhaust memory

Link for people: https://infrastack.ai/live/CVE-2026-71397 (this .md is for agents)

The grpc_server Elixir library does not enforce its max body size on client-streaming and bidirectional-streaming requests, so it buffers every chunk until a full message arrives. An unauthenticated attacker can send an oversized streamed message to exhaust memory and crash the node.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the grpc_server version in mix.lock or mix.exs; affected versions are from `1.0.0` before `1.0.6`.
- Look for streaming RPCs (client-streaming or bidirectional) exposed through the Cowboy adapter.

## Fix

- grpc_server: upgrade to `1.0.6` or later

## Timeline

- 2026-11-06T21:45:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71397

## Documents

- [advisory] Vendor advisory: github.com https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g
- [fix] Patch: github.com https://github.com/elixir-grpc/grpc/commit/0b663ca53dbf0f36f7f67ff1d0026f4482a18915
- [fix] Patch: github.com https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.

The streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.

This issue affects grpc_server: from 1.0.0 before 1.0.6.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_