CVE-2026-124279: Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server
elixir-grpc · grpc_server
Vendor fix available · Affected: elixir-grpc grpc_server · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 42% of scored CVEs
DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all. This issue affects grpc_server: from 1.0.0 before 1.1.0.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- elixir-grpc · grpc_serverfrom 1.0.0 before 1.1.0
- elixir-grpc · grpc_serverVersions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- elixir-grpc
- Published
- November 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-124279 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.