CVE-2026-123635
Description
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.
References
- https://cna.erlef.org/cves/CVE-2026-123635.html
- https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292
- https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802
- https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr
- https://osv.dev/vulnerability/EEF-CVE-2026-123635