CVE-2026-123635
Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.
| CWE | CWE-772 |
| Vendor | elixir-grpc |
| Product | grpc_server |
| Published | Nov 13, 2026 |
Get instant alerts for elixir-grpc grpc_server
Be the first to know when new unknown vulnerabilities affecting elixir-grpc grpc_server are published — delivered to Slack, Telegram or Discord.