CVE-2026-124279

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...

CVE-2026-121809

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...

EEF-CVE-2026-124279 Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...

CVE-2026-124279 Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...

CVE-2026-124279 Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...

EUVD-2026-125543

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3...

CVE-2026-124279

The elixir-grpc grpc_server component (versions 1.0.0 before 1.1.0 ) is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) issue. The root cause lies in the GRPC.Server.Adapters.Cowboy.Handler.info/3 function, which requests up to 8,000,000 bytes per read from Cowboy ...

CVE-2026-121809 CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...

EEF-CVE-2026-121809 CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server

Summary Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...

CVE-2026-121809

The elixir-grpc ecosystem is vulnerable to a CPU exhaustion attack due to a Loop with Unreachable Exit Condition in the grpc_server (versions 1.0.0 to 1.1.0) and grpc (versions 0.3.1 to 1.0.0) components. Specifically, the GRPC.Server.Adapters.Cowboy.read_stream/1 function fails to correctly hand...

EUVD-2026-125542

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...

CVE-2026-121809 CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message...

CVE-2026-124278

The elixir-grpc projects, specifically grpc_server (v1.0.0 to <1.1.0) and grpc (v0.8.0 to

CVE-2026-124278 Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpcserver and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. Only the transcoding clause of...

CVE-2026-121808 Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec

Improper Handling of Highly Compressed Data Data Amplification vulnerability in elixir-grpc grpccore and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2 grpccore/lib/grpc/codec/erlpack.ex, and...

CVE-2026-121808

The elixir-grpc grpc_core and grpc libraries are vulnerable to a Data Amplification memory exhaustion attack (CWE-409). The root cause is in GRPC.Codec.Erlpack.decode/2, which passes the message body to :erlang.binary_to_term/2 without enforcing a decoded size limit. Because the server's max_body...

CVE-2026-123635 Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server

Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpcserver allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpcstreamh grpcserver/src/grpcstreamh.er...

CVE-2026-123635

The elixir-grpc grpc_server component (versions 1.0.0 to before 1.1.0) is vulnerable to a Missing Release of Resource after Effective Lifetime (CWE-772) flaw in the grpc_stream_h handler. When a server refuses a call early (e.g., due to max_body_size limits), Cowboy drops in-flight DATA frames wi...

EEF-CVE-2026-123635 Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server

Summary Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpcserver allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpcstreamh...

PT-2026-146942

Name of the Vulnerable Software and Affected Versions elixir-grpc grpc server versions 1.0.0 through 1.0.9 Description A resource leak occurs in the grpc stream h function grpc server/src/grpc stream h.erl when the server refuses a call early, such as when the method is not implemented or the...