CVE-2026-123635

Name of the Vulnerable Software and Affected Versions elixir-grpc grpc server versions 1.0.0 through 1.0.9

Description A resource leak occurs in the grpc stream h function (grpc server/src/grpc stream h.erl) when the server refuses a call early, such as when the method is not implemented or the request body exceeds the max body size variable. In these cases, Cowboy drops DATA frames still in flight without returning their bytes to the connection flow-control window. Consequently, the connection window eventually empties, causing all subsequent calls on that shared HTTP/2 connection to stall and wait until their deadlines. This issue only affects the specific shared connection and does not impact other connections.

Recommendations Update elixir-grpc grpc server to version 1.1.0. As a temporary workaround, implement a Cowboy stream handler in front of grpc stream h using the stream handlers: [MyHandler, :grpc stream h] adapter option. In the init/3 function, the handler should call :cowboy stream.init/3 and issue a {:flow, size} command when a request has a body, where size corresponds to Cowboy's max frame size received.