CVE-2026-123635: Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server
elixir-grpc · grpc_server
Fixed in 1.1.0 · Affected: elixir-grpc grpc_server before 1.1.0 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 24% of scored CVEs
DescriptionCVE.org
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- elixir-grpc · grpc_serverfrom 1.0.0 before 1.1.0
- elixir-grpc · grpc_serverVersions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- elixir-grpc
- Published
- November 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-123635 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.