Listen to this Post
Intro
The vulnerability exists in the `GRPC.Compressor.Gzip.decompress/1` function, located in `lib/grpc/compressor/gzip.ex` at lines 12–14. This function directly invokes `:zlib.gunzip/1` on attacker-controlled bytes without any size limits, ratio checks, or incremental decoding. Since this module is registered as a `GRPC.Compressor` implementation, it is automatically invoked whenever an incoming gRPC frame carries the `grpc-encoding: gzip` header. The `:zlib.gunzip/1` call allocates the entire decompressed result as a single binary before returning. A highly compressible payload, such as a few kilobytes of zeros (which gzip compresses at roughly 1000:1 ratio), expands to multiple gigabytes inside a single function call. The server’s `max_receive_message_length` configuration is enforced only against the already-decompressed message, so it offers no protection against this attack. A single crafted request is sufficient to exhaust the BEAM node’s heap and trigger an OOM kill. The issue was introduced in commit `beae680` of the `elixir-grpc/grpc` repository. An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compressed frame that decompresses to gigabytes, causing a denial of service. The provided proof-of-concept script demonstrates the vulnerability by creating a 200 MB decompression bomb from a ~200 KB payload, which causes the node’s memory usage to balloon by hundreds of megabytes. No authentication, prior state, or special configuration is required for exploitation—only network access to the gRPC port.
DailyCVE Form:
Platform: elixir-grpc library
Version: vulnerable commits
Vulnerability: decompression bomb DoS
Severity: Critical
date: 2026-08-26
Prediction: Patch expected 2026-09-02
What Undercode Say:
- Amplification ratio ~1028.7x from 199 KB payload to 200 MB memory growth.
- Single request causes OOM kill with ~358 MB heap increase.
- Affects all gRPC services accepting gzip encoding.
- No authentication needed; exposed port sufficient.
Exploit: (Educational Purposes!)
Build and send gzip bomb frame
uncompressed_size=20010241024
bomb_payload=$(echo -n | gzip -c | dd if=/dev/zero bs=1 count=$uncompressed_size 2>/dev/null | gzip -c)
frame=$(printf "\x01%08x" ${bomb_payload} | xxd -r -p)$bomb_payload
echo -n "$frame" | nc -v target_host 50051
Protection:
- Apply patch from upstream commit fixing decompression limits.
- Disable gzip compressor support in server configuration.
- Implement custom decompressor with size and ratio checks.
- Use BEAM memory limits and OOM protection flags.
- Deploy reverse proxy with request size limiting.
Impact:
- Denial of service via remote OOM kill.
- All gRPC endpoints using this library are vulnerable.
- No authentication or special privileges required.
- Single packet can crash the entire BEAM node.
- Service availability completely disrupted.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
