Answer in brief
CVE-2026-121808 records a High severity (CVSS 8.2) vulnerability in Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codec. The current sources do not mark it as known exploited. The current feed maps elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic), elixir-grpc/grpc_core (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic), elixir-grpc/grpc_core (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| elixir-grpc/elixir-grpc/grpcgeneric | >=25bcc569fe2cc4478531a6c546c923205fc751c9 <0332faae5f5e132314794dbfdae5edecbccea292 | 0332faae5f5e132314794dbfdae5edecbccea292 |
| elixir-grpc/elixir-grpc/grpcgeneric | >=0332faae5f5e132314794dbfdae5edecbccea292 <d6bc56ac75dfb6c02db2099909210a37c9be8db6 | d6bc56ac75dfb6c02db2099909210a37c9be8db6 |
| elixir-grpc/grpcgeneric | >=0.4.0 <1.0.0 | 1.0.0 |
| elixir-grpc/grpc_coregeneric | >=1.0.0 <1.1.0 | 1.1.0 |
Published upstream
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 13, 2026
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body. This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.
Quoted source text, attributed separately from HOL analysis.