Answer in brief
CVE-2026-71397 records a High severity (CVSS 8.2) vulnerability in Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server. The current sources do not mark it as known exploited. The current feed maps elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc_server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc_server (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| elixir-grpc/elixir-grpc/grpcgeneric | >=49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 <0b663ca53dbf0f36f7f67ff1d0026f4482a18915 | 0b663ca53dbf0f36f7f67ff1d0026f4482a18915 |
| elixir-grpc/grpc_servergeneric | >=1.0.0 <1.0.6 | 1.0.6 |
Published upstream
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 6, 2026
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it. This issue affects grpc_server: from 1.0.0 before 1.0.6.
Quoted source text, attributed separately from HOL analysis.