Infinite Loop Vulnerability in elixir-grpc's gRPC Server and Client

CVE-2026-121809

What is CVE-2026-121809?

An infinite loop vulnerability exists in the elixir-grpc library affecting both the gRPC server and client implementations. Attackers can exploit this by sending a client-streaming or bidirectional-streaming request that ends prematurely, causing the server to remain in a perpetual read state. This occurs when the gRPC server continuously requests more data due to the incomplete message, resulting in the BEAM scheduler being occupied indefinitely. The issue becomes more severe with multiple requests, as each one can monopolize a scheduler until the connection is closed. Affected versions need immediate attention, as they can severely impact system performance by exhausting server resources.

References