15 matches found
CVE-2026-124279
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...
CVE-2026-121809
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...
EEF-CVE-2026-124279 Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server
Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...
CVE-2026-124279 Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...
EUVD-2026-125543
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...
CVE-2026-124279
The elixir-grpc grpc_server component (versions 1.0.0 before 1.1.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) issue. The root cause lies in the GRPC.Server.Adapters.Cowboy.Handler.info/3 function, which requests up to 8,000,000 bytes per read from Cowboy ...
EEF-CVE-2026-121809 CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server
Summary Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...
EUVD-2026-125542
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...
CVE-2026-71397
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of...
CVE-2026-71397 Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of...
CVE-2026-71397
The elixir-grpc grpc_server (versions 1.0.0 to 1.0.5 ) is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw. The root cause is that the {:read_body, ref, pid} clause in the Cowboy adapter fails to enforce the max_body_size limit, unlike the unary read path. Spec...
CVE-2026-71397 Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of...
RUSTSEC-2026-0304 Finished streaming calls keep reading a stalled request body indefinitely
Affected versions of connectrpc start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request...
Finished streaming calls keep reading a stalled request body indefinitely
Affected versions of connectrpc start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request...
PT-2026-97265
Affected versions of connectrpc start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request...