An unauthenticated attacker can cause a denial of service by occupying a BEAM scheduler indefinitely. This occurs during client-streaming or bidirectional-streaming requests when the request body ends inside a gRPC message. Specifically, the `read stream/1` function in `GRPC.Server.Adapters.Cowboy` continues to request more data when the buffer does not contain a complete message. If the request body has ended, subsequent reads return empty chunks, causing the function to retry indefinitely. A single 5-byte length prefix sent with `END STREAM` can keep one scheduler busy for the duration of the connection, and multiple such requests can exhaust all available schedulers.