CVE-2026-121809

Name of the Vulnerable Software and Affected Versions grpc server versions 1.0.0 through 1.0.9 grpc versions 0.3.1 through 0.9.9

Description An unauthenticated attacker can cause a denial of service by occupying a BEAM scheduler indefinitely. This occurs during client-streaming or bidirectional-streaming requests when the request body ends inside a gRPC message. Specifically, the read stream/1 function in GRPC.Server.Adapters.Cowboy continues to request more data when the buffer does not contain a complete message. If the request body has ended, subsequent reads return empty chunks, causing the function to retry indefinitely. A single 5-byte length prefix sent with END STREAM can keep one scheduler busy for the duration of the connection, and multiple such requests can exhaust all available schedulers.

Recommendations Update grpc server to version 1.1.0 or later. Update grpc to version 1.0.0 or later.