Read the docs
TI-2026-38512 Aliases CVE-2026-53430GHSA-6ccx-9c9f-327w

grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1

Priority HIGH 77CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb. This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2. 'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill. This issue affects grpc: from 0.4.0 before 1.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix Fixed grpc (elixir-grpc): 1.0.0grpc (Hex): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elixir-grpcgrpc0.4.0 to before 1.0.01.0.0Patch availableCNA
—grpc (Hex)0.4.0 to before 1.0.01.0.0Patch availableGHSA-6ccx-9c9f-327w
  • grpc Vendorelixir-grpc Affected 0.4.0 to before 1.0.0 Fixed in 1.0.0 Patch available CNA
  • grpc (Hex) Vendor— Affected 0.4.0 to before 1.0.0 Fixed in 1.0.0 Patch available GHSA-6ccx-9c9f-327w

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA grpc (elixir-grpc) Fixed in 1.0.0
  • Fix · GHSA-6ccx-9c9f-327w grpc (Hex) Fixed in 1.0.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    elixir-grpc grpc 1.0.0

    4 records Highest priority Priority HIGH 4 HIGH

    Other records, highest priority first

    • TI-2026-36118 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcPriority HIGH 81
    • TI-2026-36119 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpcPriority HIGH 77
    • TI-2026-35955 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcodingPriority HIGH 68
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53430
  2. 2026-10-03 Alias added: GHSA-6ccx-9c9f-327w

References

Patch 1

Advisory 2

Other 5

  • TI-2026-36118 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc CVSS 4.0CRITICAL 9.2
  • TI-2026-36119 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc CVSS 4.0HIGH 8.7
  • TI-2026-35955 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding CVSS 4.0HIGH 7.6
  • TI-2026-86129 Unbounded streaming request buffering in grpc_server exhausts memory CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences