CVE-2026-123635

Description

Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 6.3CVSS 4.0, Mediumfrom the CNA (EEF)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What to do

• Put a Cowboy stream handler in front of grpc_stream_h with the adapter option stream_handlers: [MyHandler, :grpc_stream_h]. In init/3, the handler calls :cowboy_stream.init/3 and adds a {:flow, size} command when the request has a body, where size is Cowboy's max_frame_size_received (16384 by default). It passes all other callbacks to :cowboy_stream.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally. (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-772

References

• Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_servervendor-advisoryrelated
• EEF CNA record for CVE-2026-123635related
• OSV record EEF-CVE-2026-123635related
• Introducing commit 0332faa in elixir-grpc/grpcrelated
• Fix commit 61a7194 in elixir-grpc/grpcpatch