CVE-2026-71397

Name of the Vulnerable Software and Affected Versions grpc server versions 1.0.0 through 1.0.5

Description An unauthenticated attacker can cause memory exhaustion and crash the node by sending an oversized request body via client-streaming or bidirectional-streaming. The issue occurs because the streaming read path in Elixir.GRPC.Server.Adapters.Cowboy.Handler:info/3 does not enforce the max body size limit, unlike the unary read path. Specifically, Elixir.GRPC.Server.Adapters.Cowboy:reading stream/1 appends received chunks to a buffer until a complete length-prefixed message is formed. By declaring a very large message and sending it through multiple small HTTP/2 DATA frames, an attacker can force the buffer to grow without limit, leading to a BEAM memory exhaustion and a complete node crash.

Recommendations Update grpc server to version 1.0.6.