CVE-2026-121808

Name of the Vulnerable Software and Affected Versions grpc versions 0.4.0 through 0.9.x grpc core versions 1.0.0 through 1.0.x

Description An issue exists where unauthenticated attackers can cause server memory exhaustion by sending a compressed Erlang external term within a gRPC message body. The GRPC.Codec.Erlpack.decode/2 function passes the message body to :erlang.binary to term/2, which inflates compressed terms fully without a size limit. Because the server's max body size limit only tracks compressed bytes, a request using Content-Type: application/grpc+erlpack can force the server to allocate memory significantly larger than the actual request body. This occurs because the codec's type checks are only performed after the term has been decoded.

Recommendations For grpc versions 0.4.0 through 0.9.x, update to version 1.0.0 or later. For grpc core versions 1.0.0 through 1.0.x, update to version 1.1.0 or later. As a temporary mitigation, remove GRPC.Codec.Erlpack from the server's codecs list if it is not required. If the codec is necessary, implement a wrapper codec that raises an error in the decode/2 function when the body begins with the compressed term tag bytes 131, 80.