← Back to CVE Explorer

CVE-2026-53430

Full vulnerability record from the local CVENow database.

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb. This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2. 'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill. This issue affects grpc: from 0.4.0 before 1.0.0.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-06-15 23:16:46.363000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON 
{
  "id": "CVE-2026-53430",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-06-15T23:16:46.363",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.\n\nThis vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2.\n\n'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."
    },
    {
      "lang": "es",
      "value": "Manejo Inadecuado de Datos Altamente Comprimidos (Amplificación de Datos) vulnerabilidad en elixir-grpc grpc (módulos GRPC.Compressor.Gzip, GRPC.Message) permite una denegación de servicio a través de una bomba de descompresión gzip.\n\nEsta vulnerabilidad está asociada con los archivos de programa lib/grpc/compressor/gzip.ex, lib/grpc/message.ex y las rutinas de programa ’Elixir.GRPC.Compressor.Gzip’:decompress/1, ’Elixir.GRPC.Message’:from_data/2.\n\n’Elixir.GRPC.Compressor.Gzip’:decompress/1 llama a :zlib.gunzip/1 directamente sobre bytes controlados por el atacante sin límite de tamaño descomprimido, verificación de relación o decodificación incremental. Debido a que este módulo es la implementación registrada de gzip GRPC.Compressor, se invoca automáticamente cada vez que una trama gRPC entrante lleva el encabezado grpc-encoding: gzip. :zlib.gunzip/1 asigna el resultado descomprimido completo como un único binario, por lo que una pequeña carga útil altamente compresible (por ejemplo, unos pocos kilobytes de ceros, que gzip comprime aproximadamente a 1000:1) se expande a múltiples gigabytes dentro de una sola llamada. El límite max_receive_message_length se aplica solo contra el mensaje ya descomprimido, por lo que no proporciona protección. Un par remoto no autenticado puede enviar una única trama manipulada para agotar el heap del nodo BEAM y desencadenar una terminación por falta de memoria.\n\nEste problema afecta a grpc: desde 0.4.0 antes de 1.0.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "elixir-grpc",
          "product": "grpc",
          "defaultStatus": "unaffected",
          "collectionURL": "https://hex.pm",
          "packageName": "grpc",
          "cpes": [
            "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.GRPC.Compressor.Gzip'",
            "'Elixir.GRPC.Message'"
          ],
          "programFiles": [
            "lib/grpc/compressor/gzip.ex",
            "lib/grpc/message.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"
            },
            {
              "name": "'Elixir.GRPC.Message':from_data/2"
            }
          ],
          "repo": "https://github.com/elixir-grpc/grpc",
          "packageURL": "pkg:hex/grpc",
          "versions": [
            {
              "version": "0.4.0",
              "lessThan": "1.0.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "elixir-grpc",
          "product": "grpc",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "elixir-grpc/grpc",
          "cpes": [
            "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.GRPC.Compressor.Gzip'",
            "'Elixir.GRPC.Message'"
          ],
          "programFiles": [
            "lib/grpc/compressor/gzip.ex",
            "lib/grpc/message.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"
            },
            {
              "name": "'Elixir.GRPC.Message':from_data/2"
            }
          ],
          "repo": "https://github.com/elixir-grpc/grpc",
          "packageURL": "pkg:github/elixir-grpc/grpc",
          "versions": [
            {
              "version": "beae6800fc8baf126f3fe7107d86a50e105275ba",
              "lessThan": "1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T14:42:39.467618Z",
          "id": "CVE-2026-53430",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-409"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-53430.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53430",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}