Resource Management Flaw in elixir-grpc grpc_server Affects HTTP/2 Connections

CVE-2026-123635

What is CVE-2026-123635?

The elixir-grpc grpc_server exhibits a resource management flaw, allowing a client to cause a stall in all subsequent calls over a shared HTTP/2 connection. When a request is refused by the server, such as when the request body exceeds the maximum size or an unsupported method is used, the server fails to properly release the resources allocated for the data frames that are still being transmitted. This results in the connection's flow-control window draining since bytes from refused calls are not returned. Consequently, further requests are unable to send data, effectively blocking client-server interactions on that connection until their deadlines are reached. It is important to note that this issue does not affect other connections.

References