{"affected":[{"defaultStatus":"unaffected","ecosystem":"hex","packageName":"grpc","product":"grpc","source":"CNA: EEF","vendor":"elixir-grpc","versions":[{"lessThan":"1.0.0","status":"affected","version":"0.4.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"elixir-grpc/grpc","product":"grpc","source":"CNA: EEF","vendor":"elixir-grpc","versions":[{"lessThan":"0332faae5f5e132314794dbfdae5edecbccea292","status":"affected","version":"25bcc569fe2cc4478531a6c546c923205fc751c9","versionType":"git"}]},{"defaultStatus":"unaffected","ecosystem":"hex","packageName":"grpc_core","product":"grpc_core","source":"CNA: EEF","vendor":"elixir-grpc","versions":[{"lessThan":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"elixir-grpc/grpc","product":"grpc_core","source":"CNA: EEF","vendor":"elixir-grpc","versions":[{"lessThan":"d6bc56ac75dfb6c02db2099909210a37c9be8db6","status":"affected","version":"0332faae5f5e132314794dbfdae5edecbccea292","versionType":"git"}]}],"cveId":"CVE-2026-121808","cwes":["CWE-409"],"description":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body.\n\nGRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794584929871,"publishedAt":1794584929871,"references":[{"source":"CNA: EEF","tags":["vendor-advisory","related"],"url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xxp9-7hp4-rqwp"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-121808.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-121808"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6"}],"remediation":[{"kind":"workaround","source":"CNA: EEF","text":"Remove GRPC.Codec.Erlpack from the server's codecs list if the codec is not needed.\n\nIf the codec is needed, register a wrapper codec in its place. The wrapper implements the GRPC.Codec behaviour, returns \"erlpack\" from name/0, raises in decode/2 when the body starts with the bytes 131, 80 (the compressed term tag), and delegates all other calls to GRPC.Codec.Erlpack."},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6"}],"revision":"6a798f7c94d2442cec355a368b96d7be1598b161de5a0163b4857943b478ce9d","sources":[{"modifiedAt":1794584929871,"name":"CNA: EEF","retrievedAt":1794586141044,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121808"}],"ssvc":null,"status":"published","title":"Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec","updatedAt":1794586141044}