CVE-2026-121808
HIGHAttack Surface
CVSS Vector Breakdown
Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body. This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| elixir-grpc | grpc | 0.4.0 < 1.0.0 |
| elixir-grpc | grpc | 25bcc569fe2cc4478531a6c546c923205fc751c9 < 0332faae5f5e132314794dbfdae5edecbccea292 |
| elixir-grpc | grpc_core | 1.0.0 < 1.1.0 |
| elixir-grpc | grpc_core | 0332faae5f5e132314794dbfdae5edecbccea292 < d6bc56ac75dfb6c02db2099909210a37c9be8db6 |