Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to…
CVE-2026-121809
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpcserver and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message. GRPC.Server.Adapters.Cowboy.readstream/1 (grpcserver/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with ENDSTREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers. This issue affects grpcserver: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
Assessment
- CVSS
- 8.2 (v4.0)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 13 November 2026
- Last updated
- 13 November 2026
- Affected
- elixir-grpc · gRPC · grpc_server
- Assigner
- EEF
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
At the source
References
- https://github.com/elixir-grpc/grpc/security/advisories/GHSA-c2h9-f9cc-27xh
- https://cna.erlef.org/cves/CVE-2026-121809.html
- https://osv.dev/vulnerability/EEF-CVE-2026-121809
- https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292
- https://github.com/elixir-grpc/grpc/commit/38955f1392cbf08eef231a347348445410455c85
- https://github.com/elixir-grpc/grpc/commit/6d8a09ad919e208fb600538ac8b19bd733a04310
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-121809