CVE-2026-71397— Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server

Quick assessment

Affected

elixir-grpc grpc_server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在的组件中存在“无限制或无节流地分配资源”的漏洞。该漏洞允许未认证的攻击者通过发送过大的客户端流式（client-streaming）或双向流式（bidirectional-streaming）请求体，耗尽服务器内存并导致节点崩溃。具体而言，模块中的流式读取子句（即函数，位于）从未检查配置项的限制。只有单路（unary）读取路径会强制执行该上限。而模块中的函数（位于）会在接收到完整的长度前缀消息之前，将每个接收到的数据块（chunk）持续追加到其缓冲区中。攻击者可以声明一个非常大的消息，并通过多

CVSS 8.2 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it. This issue affects grpc_server: from 1.0.0 before 1.0.6.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
elixir-grpc	grpc_server	1.0.0 ~ 1.0.6	`cpe:2.3:a:elixir-grpc:grpc_server::::::::`
elixir-grpc	grpc_server	49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 ~ 0b663ca53dbf0f36f7f67ff1d0026f4482a18915	`cpe:2.3:a:elixir-grpc:grpc_server::::::::`