Resource Exhaustion Vulnerability in Elixir GRPC's grpc_server

CVE-2026-71397

What is CVE-2026-71397?

A vulnerability exists in Elixir GRPC's grpc_server that allows unauthenticated attackers to exploit the server by sending oversized client-streaming or bidirectional-streaming requests. The server fails to enforce the configured maximum body size during streaming reads, leading to unbounded accumulation of request data. This oversight can result in significant memory exhaustion, ultimately leading to a crash of the node, rendering the service unavailable.

References