# CVE-2026-53430: elixir-grpc grpc denial of service via gzip decompression bomb

Source: https://junglewise.ai/threats/cve-2026-53430-elixir-grpc-grpc-denial-of-service-via-gzip-decompression-bomb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-53430 · Severity: high · CVSS 8.7 · Published 2026-06-15

The elixir-grpc library used to build gRPC servers contains a flaw in its gzip decompression handling that allows unauthenticated attackers to crash a server with a single malformed request. An attacker can send a highly compressed payload (hundreds of kilobytes) that decompresses to gigabytes, exhausting the server's memory and causing an out-of-memory crash. No special access, authentication, or configuration is required—any gRPC endpoint accepting compressed requests is vulnerable.

## Quick answers

**Is CVE-2026-53430 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53430 being exploited in the wild.

**How severe is CVE-2026-53430?** High severity, with a CVSS score of 8.7, published 15 June 2026.

**Which products and versions are affected?** elixir-grpc grpc >=0.4.0, <1.0.0.

**Is there a fix for CVE-2026-53430?** A patch was published on 2026-06-15: Fixed in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53430 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53430?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a decompression bomb (CWE-409) in GRPC.Compressor.Gzip.decompress/1 (lib/grpc/compressor/gzip.ex:12-14). The function calls Erlang's :zlib.gunzip/1 directly on untrusted bytes without enforcing any size limits, decompression ratios, or incremental processing. The vulnerable code is automatically invoked whenever an incoming gRPC frame carries the grpc-encoding: gzip header, making it accessible to any network peer without authentication. The :zlib.gunzip/1 function allocates the entire decompressed output in a single binary, so a highly compressible payload (e.g., repeated zeros compressed ~1000:1) expands to multiple gigabytes inside one function call, exhausting BEAM heap memory. Existing server-side protections like max_receive_message_length are enforced only post-decompression and cannot prevent this attack. A single crafted request is sufficient to trigger out-of-memory conditions and crash the server node.

## Affected products

- elixir-grpc grpc >=0.4.0, <1.0.0

## Identifiers

- CVE-2026-53430
- GHSA-6ccx-9c9f-327w

## Timeline

- 2026-06-15: disclosed: Advisory published by GitHub Security Lab
- 2026-08-25: advisory: Published to GitHub Advisory Database
- 2026-06-15: patched: Fixed in version 1.0.0

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)