{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121809", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-11-13T11:19:13.834Z", "datePublished": "2026-11-13T16:18:37.954Z", "dateUpdated": "2026-11-13T16:18:37.954Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Server.Adapters.Cowboy'"], "packageName": "grpc_server", "packageURL": "pkg:hex/grpc_server", "product": "grpc_server", "programFiles": ["lib/grpc/server/adapters/cowboy.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}, {"name": "'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Server.Adapters.Cowboy'"], "packageName": "elixir-grpc/grpc", "packageURL": "pkg:github/elixir-grpc/grpc", "product": "grpc_server", "programFiles": ["grpc_server/lib/grpc/server/adapters/cowboy.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}, {"name": "'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "38955f1392cbf08eef231a347348445410455c85", "status": "affected", "version": "0332faae5f5e132314794dbfdae5edecbccea292", "versionType": "git"}]}, {"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Server.Adapters.Cowboy'"], "packageName": "grpc", "packageURL": "pkg:hex/grpc", "product": "grpc", "programFiles": ["lib/grpc/server/adapters/cowboy.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}, {"name": "'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1.0.0", "status": "affected", "version": "0.3.1", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Server.Adapters.Cowboy'"], "packageName": "elixir-grpc/grpc", "packageURL": "pkg:github/elixir-grpc/grpc", "product": "grpc", "programFiles": ["lib/grpc/server/adapters/cowboy.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}, {"name": "'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "0332faae5f5e132314794dbfdae5edecbccea292", "status": "affected", "version": "6d8a09ad919e208fb600538ac8b19bd733a04310", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The server must expose at least one client-streaming or bidirectional-streaming RPC method.</p>"}, {"base64": false, "type": "text/markdown", "value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."}], "value": "The server must expose at least one client-streaming or bidirectional-streaming RPC method."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.1.0", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.0", "versionStartIncluding": "0.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Adam Jordan"}, {"lang": "en", "type": "finder", "value": "Adam Jordan"}, {"lang": "en", "type": "remediation developer", "value": "Marko Vejnovic"}, {"lang": "en", "type": "remediation reviewer", "value": "Paulo Valente"}, {"lang": "en", "type": "coordinator", "value": "Peter Ullrich"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-11-13T11:19:46.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.</p>\n<p><code>GRPC.Server.Adapters.Cowboy.read_stream/1</code> (<code>grpc_server/lib/grpc/server/adapters/cowboy.ex</code>, and the Cowboy adapter in <code>grpc</code> before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with <code>END_STREAM</code> keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.</p>\n<p>This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\n`GRPC.Server.Adapters.Cowboy.read_stream/1` (`grpc_server/lib/grpc/server/adapters/cowboy.ex`, and the Cowboy adapter in `grpc` before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with `END_STREAM` keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."}], "value": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\nGRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node.</p>"}, {"base64": false, "type": "text/markdown", "value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."}], "value": "An unauthenticated client can keep one scheduler busy per open connection with a 5-byte request, and enough connections deny service to every application on the node."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-13T16:18:37.954Z"}, "references": [{"name": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server", "tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-c2h9-f9cc-27xh"}, {"name": "EEF CNA record for CVE-2026-121809", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-121809.html"}, {"name": "OSV record EEF-CVE-2026-121809", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-121809"}, {"name": "Introducing commit 0332faa in elixir-grpc/grpc", "tags": ["related"], "url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"}, {"name": "Fix commit 38955f1 in elixir-grpc/grpc", "tags": ["patch"], "url": "https://github.com/elixir-grpc/grpc/commit/38955f1392cbf08eef231a347348445410455c85"}, {"name": "Introducing commit 6d8a09a in elixir-grpc/grpc", "tags": ["related"], "url": "https://github.com/elixir-grpc/grpc/commit/6d8a09ad919e208fb600538ac8b19bd733a04310"}], "source": {"discovery": "EXTERNAL"}, "title": "CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server", "x_proofOfConcept": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ol>\n<li>Start a server that exposes a client-streaming RPC, for example <code>RouteGuide.RecordRoute</code>.</li>\n<li>Open an HTTP/2 connection and send <code>HEADERS</code> for that method with <code>content-type: application/grpc</code> and no <code>grpc-timeout</code>.</li>\n<li>Send one <code>DATA</code> frame with <code>END_STREAM</code> that holds only the 5-byte prefix <code>00 00 00 00 64</code>, which declares a 100-byte message.</li>\n<li>Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "1. Start a server that exposes a client-streaming RPC, for example `RouteGuide.RecordRoute`.\n2. Open an HTTP/2 connection and send `HEADERS` for that method with `content-type: application/grpc` and no `grpc-timeout`.\n3. Send one `DATA` frame with `END_STREAM` that holds only the 5-byte prefix `00 00 00 00 64`, which declares a 100-byte message.\n4. Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."}], "value": "* Start a server that exposes a client-streaming RPC, for example RouteGuide.RecordRoute.\n* Open an HTTP/2 connection and send HEADERS for that method with content-type: application/grpc and no grpc-timeout.\n* Send one DATA frame with END_STREAM that holds only the 5-byte prefix 00 00 00 00 64, which declares a 100-byte message.\n* Keep the connection open and observe that no response arrives and one BEAM scheduler stays at 100% CPU until the connection closes."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>1. A partial message</strong></p>\n<p>A client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with <code>END_STREAM</code>.</p>\n<p><strong>2. The reader asks for more</strong></p>\n<p><code>read_stream/1</code> calls <code>GRPC.Message.get_message/1</code>, which returns <code>false</code> because the declared message is incomplete. <code>read_stream/1</code> then sets <code>need_more</code> and reads again through <code>Handler.read_body/1</code>.</p>\n<p><strong>3. Every read is empty</strong></p>\n<p>Once the body has been read, the handler's <code>async_read_body/2</code> (and <code>cowboy_req:read_body/2</code> in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.</p>\n<p><strong>4. No timeout ends it</strong></p>\n<p>Each iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a <code>grpc-timeout</code> header there is no deadline, and the adapter's idle timeout defaults to <code>:infinity</code>. One scheduler stays at full load until the client closes the connection.</p>"}, {"base64": false, "type": "text/markdown", "value": "**1. A partial message**\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with `END_STREAM`.\n\n**2. The reader asks for more**\n\n`read_stream/1` calls `GRPC.Message.get_message/1`, which returns `false` because the declared message is incomplete. `read_stream/1` then sets `need_more` and reads again through `Handler.read_body/1`.\n\n**3. Every read is empty**\n\nOnce the body has been read, the handler's `async_read_body/2` (and `cowboy_req:read_body/2` in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n**4. No timeout ends it**\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a `grpc-timeout` header there is no deadline, and the adapter's idle timeout defaults to `:infinity`. One scheduler stays at full load until the client closes the connection."}], "value": "1. A partial message\n\nA client sends a 5-byte gRPC length prefix that declares more bytes than follow it, and ends the request body with END_STREAM.\n\n2. The reader asks for more\n\nread_stream/1 calls GRPC.Message.get_message/1, which returns false because the declared message is incomplete. read_stream/1 then sets need_more and reads again through Handler.read_body/1.\n\n3. Every read is empty\n\nOnce the body has been read, the handler's async_read_body/2 (and cowboy_req:read_body/2 in older releases) returns an empty chunk at once. The buffer stays the same, the exit clause for an empty finished buffer never matches, and the loop repeats.\n\n4. No timeout ends it\n\nEach iteration is a message round trip between two local processes, not a socket wait, so no I/O timeout applies. Without a grpc-timeout header there is no deadline, and the adapter's idle timeout defaults to :infinity. One scheduler stays at full load until the client closes the connection."}]}}}

{}

{}

{}

{}