Executive brief
gRPC Erlang is a remote procedure call framework used by Elixir applications to expose microservices. A vulnerability in its HTTP/2 request handler allows unauthenticated attackers to crash the server by sending large or slow-drip request bodies that accumulate unbounded in memory. An attacker can send a single malicious HTTP/2 request to any gRPC endpoint, causing the server process to consume memory until it runs out and terminates, disrupting service availability.
Technical details
The vulnerability is an unbounded resource allocation issue (CWE-770) in the Cowboy HTTP/2 adapter's read_full_body/3 function. The function recursively calls cowboy_req:read_body/2 and concatenates chunks into a growing binary using the `<>` operator with no cumulative size check or configurable maximum. When the optional grpc-timeout header is omitted, timeout_left_opt(nil) returns :infinity, removing per-chunk read deadlines. HTTP/2 WINDOW_UPDATE frames issued by Cowboy allow clients to continue pushing data indefinitely. An attacker can exploit this via a POST request to any unary RPC path with Content-Type: application/grpc+proto, omitting the grpc-timeout header, and streaming a large body without sending END_STREAM. The vulnerability affects gRPC versions ≥ 0.3.1 and is fixed in version 1.0.0.
Affected products
- elixir-grpc grpc >= 0.3.1, < 1.0.0
Timeline
- 2026-06-15: disclosed: Vulnerability publicly disclosed in NVD
- 2026-08-25: advisory: GitHub Advisory Database (GHSA-q8gf-9rvj-gmgj) published
- 2026-08-25: patched: Fixed in version 1.0.0