CVE-2026-53430: elixir-grpc grpc denial of service via gzip decompression bomb

CVE-2026-53430 · Severity: high · CVSS 8.7 · Published 2026-06-15

The elixir-grpc library used to build gRPC servers contains a flaw in its gzip decompression handling that allows unauthenticated attackers to crash a server with a single malformed request. An attacker can send a highly compressed payload (hundreds of kilobytes) that decompresses to gigabytes, exhausting the server's memory and causing an out-of-memory crash. No special access, authentication, or configuration is required—any gRPC endpoint accepting compressed requests is vulnerable.

Quick answers

Is CVE-2026-53430 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53430 being exploited in the wild.
How severe is CVE-2026-53430?
High severity, with a CVSS score of 8.7, published 15 June 2026.
Which products and versions are affected?
elixir-grpc grpc >=0.4.0, <1.0.0.
Is there a fix for CVE-2026-53430?
A patch was published on 2026-06-15: Fixed in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53430 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53430?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a decompression bomb (CWE-409) in GRPC.Compressor.Gzip.decompress/1 (lib/grpc/compressor/gzip.ex:12-14). The function calls Erlang's :zlib.gunzip/1 directly on untrusted bytes without enforcing any size limits, decompression ratios, or incremental processing. The vulnerable code is automatically invoked whenever an incoming gRPC frame carries the grpc-encoding: gzip header, making it accessible to any network peer without authentication. The :zlib.gunzip/1 function allocates the entire decompressed output in a single binary, so a highly compressible payload (e.g., repeated zeros compressed ~1000:1) expands to multiple gigabytes inside one function call, exhausting BEAM heap memory. Existing server-side protections like max_receive_message_length are enforced only post-decompression and cannot prevent this attack. A single crafted request is sufficient to trigger out-of-memory conditions and crash the server node.

Affected products

  • elixir-grpc grpc >=0.4.0, <1.0.0

Identifiers

  • CVE-2026-53430
  • GHSA-6ccx-9c9f-327w

Timeline

  • 2026-06-15: disclosed: Advisory published by GitHub Security Lab
  • 2026-08-25: advisory: Published to GitHub Advisory Database
  • 2026-06-15: patched: Fixed in version 1.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.