CVE-2026-121808
Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec
- High 8.2
Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body. This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
Key facts
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- EEF
- EPSS
- 0.702% likely to be exploited in the next 30 days, higher than 53.806% of CVEs (scores for 15 Nov 2026)
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 8.2CVSS 4.0, Highfrom the CNA (EEF)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
What to do
- Remove GRPC.Codec.Erlpack from the server's codecs list if the codec is not needed. If the codec is needed, register a wrapper codec in its place. The wrapper implements the GRPC.Codec behaviour, returns "erlpack" from name/0, raises in decode/2 when the body starts with the bytes 131, 80 (the compressed term tag), and delegates all other calls to GRPC.Codec.Erlpack.CNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
An unauthenticated client can make a server that registers the Erlpack codec allocate memory far beyond the size of the request with one request. Memory exhaustion affects every service on that node. (CNA impact statement)
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| elixir-grpc | grpc |
|
| elixir-grpc | grpc |
|
| elixir-grpc | grpc_core |
|
| elixir-grpc | grpc_core |
|
Timeline
- 13 Nov 2026 Published