Improper Handling of Highly Compressed Data in elixir-grpc by Elixir

CVE-2026-53430

What is CVE-2026-53430?

An issue exists within the Elixir gRPC implementation due to improper handling of highly compressed data, allowing attackers to exploit gzip decompression. When an unauthenticated remote peer sends a specially crafted frame with a gzip header, the system invokes the gzip decompressor without appropriate size checks. This can result in a denial of service as a small incoming payload can expand to consume vast amounts of memory, potentially exhausting the system's resources and leading to an out-of-memory kill. The vulnerability is tied to specific program files and routines that lack the necessary safety mechanisms to mitigate such risks.

References