Memory Exhaustion Vulnerability in Elixir gRPC Framework

CVE-2026-121808

What is CVE-2026-121808?

A vulnerability in the Elixir gRPC framework allows unauthenticated attackers to potentially exhaust server memory by exploiting improperly managed compressed Erlang external terms. When a gRPC message body is passed without adequate constraints, the server can allocate memory for inflated data sizes that exceed defined limits. This situation arises when the server processes requests with a Content-Type of application/grpc+erlpack, creating a risk of memory exhaustion due to the absence of restrictions on decoded term sizes. Systems running specific versions of gRPC and grpc_core are susceptible to this issue, necessitating prompt attention and patching.

References