CVE-2026-71397 PUBLISHED

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.

The streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.

This issue affects grpc_server: from 1.0.0 before 1.0.6.

The server must expose at least one client-streaming or bidirectional-streaming RPC method.

• Arpit Jain finder
• Arpit Jain reporter
• Arpit Jain remediation developer
• Paulo Valente remediation reviewer
• Jonatan Männchen / EEF coordinator

• Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
• EEF CNA record for CVE-2026-71397
• OSV record EEF-CVE-2026-71397
• Introducing commit 49e18c3 in elixir-grpc/grpc
• Fix commit 0b663ca in elixir-grpc/grpc

• CWE-770 Allocation of Resources Without Limits or Throttling CWE

• An unauthenticated client can crash a grpc_server node through one streaming RPC connection. This takes down every service on that node.