Listen to this Post
The vulnerability resides in the `Elixir.GRPC.Server.Adapters.Cowboy.Handler’:read_full_body/3` function within the `lib/grpc/server/adapters/cowboy/handler.ex` file. This function is responsible for reading the entire body of an incoming HTTP/2 request. It does so by recursively calling `:cowboy_req.read_body/2` and concatenating each received chunk of data into a single, growing binary (body <> data).
The core of the issue is the complete absence of any size limit or throttling mechanism on this accumulation process. There is no check on the total running size of the body being assembled, nor is there any configurable maximum body size parameter. This means an attacker can send a request with an arbitrarily large body.
The situation is exacerbated by the handling of the `grpc-timeout` header. This header is attacker-supplied and optional. When a client omits it, the `timeout_left_opt(nil)` function returns :infinity. This `:infinity` value is then used as the read timeout for each `:cowboy_req.read_body/2` call, meaning the per-chunk read operation has no deadline.
These two missing controls compound the risk in two significant ways:
1. Fast Flood: A client can send a multi-gigabyte payload at full speed. The server will rapidly accumulate this data in memory, leading to a quick exhaustion of the BEAM’s available memory.
2. Slow Trickle: A client can send the body in very small chunks over an extended period, never sending the final `END_STREAM` flag. Because there is no per-chunk read timeout, the server will keep the connection open indefinitely, slowly but surely consuming memory until the node crashes.
Critically, as the loop drains the receive buffer, the Cowboy web server issues fresh HTTP/2 `WINDOW_UPDATE` frames, allowing the client to continue pushing data without being flow-controlled. This vulnerability requires no authentication, no special server configuration, and no specific RPC method. The unbounded read is on the default unary ingress path, making any unauthenticated HTTP/2 connection a potential attack vector. A single connection is sufficient to exhaust the memory of the BEAM VM and crash the entire Erlang node.
DailyCVE Form:
Platform: Elixir gRPC
Version: 0.3.1 – 0.10.2
Vulnerability: Unbounded Memory Allocation
Severity: High (CVSS 8.7)
date: 2026-06-15
Prediction: 2026-07-15
What Undercode Say:
Analytics show this is a critical resource exhaustion flaw. The following can be used to simulate or analyze the issue.
Exploit: (Educational Purposes!)
Example using grpcurl to stream a large payload without a timeout This command sends 1GB of zeroes in a streaming fashion. Note: The --insecure flag is for local testing only. dd if=/dev/zero bs=1M count=1024 | grpcurl -plaintext -d @ your-server:50051 your.package.YourService/YourMethod
Protection:
- Upgrade: The primary and most effective fix is to upgrade to version `1.0.0` or later.
- Configuration: If an upgrade is not immediately possible, implement a reverse proxy (like NGINX or HAProxy) in front of the gRPC server to enforce a maximum body size limit and connection timeouts.
- Monitoring: Implement monitoring on BEAM memory usage to detect anomalous growth patterns indicative of an attack.
Impact:
- Denial of Service (DoS): An unauthenticated remote attacker can exhaust the server’s memory, causing the Erlang VM (BEAM) to crash.
- Service Disruption: The crash of the node results in a complete loss of service for all gRPC endpoints hosted on that instance.
- Widespread Applicability: The vulnerability exists in the default unary request path, affecting all versions from 0.3.1 up to, but not including, 1.0.0. No special configuration or authentication is required to exploit it.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
