Unbounded streaming request buffering in grpc_server exhausts memory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.
Summary
The grpc_server package from elixir-grpc, from 1.0.0 before 1.0.6, does not enforce its max_body_size limit on client-streaming and bidirectional-streaming RPCs. Due to allocation of resources without limits (CWE-770), an unauthenticated remote attacker can send an oversized streaming message in many small chunks, and the server buffers all of it until memory is exhausted and the node crashes.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it. This issue affects grpc_server: from 1.0.0 before 1.0.6.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elixir-grpc | grpc_server | 1.0.0 to before 1.0.6 | 1.0.6 | Patch available | CNA |
- grpc_server Vendorelixir-grpc Affected 1.0.0 to before 1.0.6 Fixed in 1.0.6 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Update grpc_server to version 1.0.6, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA grpc_server (elixir-grpc) Fixed in 1.0.6
Timeline
- 2026-11-06 Threatist record created from CVE-2026-71397
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More elixir-grpc vulnerabilities
- TI-2026-36118 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc CVSS 4.0CRITICAL 9.2
- TI-2026-38512 grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1 CVSS 4.0HIGH 8.7
- TI-2026-36119 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc CVSS 4.0HIGH 8.7
- TI-2026-35955 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding CVSS 4.0HIGH 7.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences