CVE-2026-121809
HIGHAttack Surface
CVSS Vector Breakdown
Description
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message. GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
Weakness Classification (2)
Affected Software (8)
| Vendor | Product | Version |
|---|---|---|
| elixir-grpc | grpc | 0.3.1 < 1.0.0 |
| elixir-grpc | grpc | 6d8a09ad919e208fb600538ac8b19bd733a04310 < 0332faae5f5e132314794dbfdae5edecbccea292 |
| elixir-grpc | grpc | 0.3.1 < 1.0.0 |
| elixir-grpc | grpc | 6d8a09ad919e208fb600538ac8b19bd733a04310 < 0332faae5f5e132314794dbfdae5edecbccea292 |
| elixir-grpc | grpc_server | 1.0.0 < 1.1.0 |
| elixir-grpc | grpc_server | 0332faae5f5e132314794dbfdae5edecbccea292 < 38955f1392cbf08eef231a347348445410455c85 |
| elixir-grpc | grpc_server | 1.0.0 < 1.1.0 |
| elixir-grpc | grpc_server | 0332faae5f5e132314794dbfdae5edecbccea292 < 38955f1392cbf08eef231a347348445410455c85 |