CVE-2026-121809

CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server

High 8.2

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message. GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.

Key facts

Published: 13 Nov 2026
Last changed: 13 Nov 2026
Assigned by: EEF
EPSS: 0.655% likely to be exploited in the next 30 days, higher than 51.954% of CVEs (scores for 15 Nov 2026)
SSVC (CISA): Exploitation: none; Automatable: no; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

8.2CVSS 4.0, Highfrom the CNA (EEF)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node. (CNA impact statement)

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
elixir-grpc	grpc_server	Default status: unaffected 1.0.0 up to but excluding 1.1.0 (affected)
elixir-grpc	grpc_server	Default status: unaffected 0332faae5f5e132314794dbfdae5edecbccea292 up to but excluding 38955f1392cbf08eef231a347348445410455c85 (affected)
elixir-grpc	grpc	Default status: unaffected 0.3.1 up to but excluding 1.0.0 (affected)
elixir-grpc	grpc	Default status: unaffected 6d8a09ad919e208fb600538ac8b19bd733a04310 up to but excluding 0332faae5f5e132314794dbfdae5edecbccea292 (affected)

Timeline

13 Nov 2026 Published

Weakness

References

CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_servervendor-advisoryrelated
EEF CNA record for CVE-2026-121809related
OSV record EEF-CVE-2026-121809related
Introducing commit 0332faa in elixir-grpc/grpcrelated
Fix commit 38955f1 in elixir-grpc/grpcpatch
Introducing commit 6d8a09a in elixir-grpc/grpcrelated