elixir-grpc CVE-2026-53430
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Single unauthenticated network frame with gzip header triggers OOM on the BEAM node, so AV:N/AC:L/PR:N/UI:N and availability-only impact A:H with C:N/I:N.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.
This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2.
'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.
This issue affects grpc: from 0.4.0 before 1.0.0.
AnalysisAI
Denial of service in the elixir-grpc library (versions 0.4.0 through 0.x) allows unauthenticated remote attackers to crash BEAM nodes via a gzip decompression bomb. The GRPC.Compressor.Gzip module calls :zlib.gunzip/1 directly on attacker-controlled bytes without size limits, ratio checks, or incremental decoding, so a single small frame carrying the grpc-encoding: gzip header expands to multi-gigabyte allocations and triggers OOM kills. No public exploit identified at time of analysis, but a vendor patch is available in version 1.0.0.
Technical ContextAI
elixir-grpc is the de-facto gRPC implementation for the Elixir/Erlang ecosystem, running on the BEAM virtual machine. The vulnerability sits in lib/grpc/compressor/gzip.ex within the 'Elixir.GRPC.Compressor.Gzip':decompress/1 routine, which is the registered handler for the grpc-encoding: gzip header and is therefore invoked automatically by lib/grpc/message.ex's 'Elixir.GRPC.Message':from_data/2 whenever a peer advertises gzip compression. The root cause is CWE-409 (Improper Handling of Highly Compressed Data, a.k.a. data amplification / zip bomb). :zlib.gunzip/1 is a one-shot Erlang built-in that materializes the entire decompressed output as a single binary on the process heap, with no streaming or upper bound. Gzip's DEFLATE algorithm routinely achieves ~1000:1 ratios on runs of zeros, so a few kilobytes inflate to multi-gigabyte allocations. The max_receive_message_length guard is applied to the already-decompressed payload, so it is structurally incapable of preventing this allocation. CPE coverage is cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: upgrade elixir-grpc grpc to version 1.0.0 or later, which rewrites GRPC.Compressor.Gzip.decompress/1 to use :zlib.inflateInit with windowBits 31 and feeds the compressed input in 8 KB slices, aborting with GRPC.RPCError status :resource_exhausted as soon as the decompressed accumulator exceeds the limit (default 4 MB, matching gRPC-Go); the limit is tunable via Application.put_env(:grpc, :max_decompressed_message_length, bytes). The fix commit is https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc and the full advisory is at https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w. If immediate upgrade is not possible, compensating controls include stripping or rejecting the grpc-encoding: gzip header at an upstream proxy (Envoy, nginx, or a service mesh sidecar) so frames never reach the Elixir decoder - this disables legitimate gzip compression and increases bandwidth use - or fronting the service with a WAF/proxy that enforces a strict pre-decompression frame size cap (note that small bombs still slip under any reasonable cap, so this is partial mitigation only). Restricting gRPC ingress to authenticated/mTLS peers reduces exposure but does not eliminate it where authenticated clients are themselves untrusted.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the ba
Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_uni
Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c. R
Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomg
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPac
Unsafe Erlang term deserialization in the elixir-grpc library (versions 0.4.0 through 1.0.0) allows unauthenticated remo
Unauthenticated denial of service in the elixir-grpc library (versions 0.3.1 up to but not including 1.0.0) allows a sin
Authorization bypass in elixir-grpc (grpc library for Elixir) versions 0.8.0 through 0.x allows authenticated attackers
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Rated
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clien
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today