Executive brief
The elixir-grpc library used to build gRPC servers contains a flaw in its gzip decompression handling that allows unauthenticated attackers to crash a server with a single malformed request. An attacker can send a highly compressed payload (hundreds of kilobytes) that decompresses to gigabytes, exhausting the server's memory and causing an out-of-memory crash. No special access, authentication, or configuration is required—any gRPC endpoint accepting compressed requests is vulnerable.
Technical details
The vulnerability is a decompression bomb (CWE-409) in GRPC.Compressor.Gzip.decompress/1 (lib/grpc/compressor/gzip.ex:12-14). The function calls Erlang's :zlib.gunzip/1 directly on untrusted bytes without enforcing any size limits, decompression ratios, or incremental processing. The vulnerable code is automatically invoked whenever an incoming gRPC frame carries the grpc-encoding: gzip header, making it accessible to any network peer without authentication. The :zlib.gunzip/1 function allocates the entire decompressed output in a single binary, so a highly compressible payload (e.g., repeated zeros compressed ~1000:1) expands to multiple gigabytes inside one function call, exhausting BEAM heap memory. Existing server-side protections like max_receive_message_length are enforced only post-decompression and cannot prevent this attack. A single crafted request is sufficient to trigger out-of-memory conditions and crash the server node.
Affected products
- elixir-grpc grpc >=0.4.0, <1.0.0
Timeline
- 2026-06-15: disclosed: Advisory published by GitHub Security Lab
- 2026-08-25: advisory: Published to GitHub Advisory Database
- 2026-06-15: patched: Fixed in version 1.0.0