CVE-2026-121808
Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body. This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
| CWE | CWE-409 |
| Vendor | elixir-grpc |
| Product | grpc |
| Published | Nov 13, 2026 |
Get instant alerts for elixir-grpc grpc
Be the first to know when new unknown vulnerabilities affecting elixir-grpc grpc are published — delivered to Slack, Telegram or Discord.