Resource Exhaustion Vulnerability in Elixir-grpc gRPC Server

CVE-2026-124279

What is CVE-2026-124279?

The Elixir-grpc gRPC Server contains a vulnerability that enables unauthenticated attackers to potentially exhaust server memory. This occurs through client-streaming or bidirectional-streaming requests that buffer data without appropriate limits. Specifically, the server can accept streaming requests that exceed the configured limits, allowing numerous concurrent streams to consume excessive memory resources. This issue affects all versions prior to 1.0.6, leading to a risk of server instability.

References