CVE-2026-53430: CVE-2026-53430: Unauthenticated Remote Denial of Service via Gzip Decompression Bomb in elixir-grpc/grpc

CVE-2026-53430: Unauthenticated Remote Denial of Service via Gzip Decompression Bomb in elixir-grpc/grpc

Vulnerability ID: CVE-2026-53430
CVSS Score: 8.7
Published: 2026-08-25

CVE-2026-53430 is a critical uncontrolled resource consumption vulnerability in the elixir-grpc/grpc library. An unauthenticated remote attacker can cause immediate memory exhaustion and system crashes by sending crafted gRPC frames compressed with Gzip, leading to a complete Denial of Service.

TL;DR

Unauthenticated remote attackers can crash Elixir-based gRPC servers by sending a small, highly compressed Gzip payload that expands to multiple gigabytes, triggering an Out-Of-Memory crash.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-409
• Attack Vector: Network
• CVSS 4.0 Score: 8.7
• EPSS Score: 0.00348 (0.35% exploitation probability)
• Impact: Complete Denial of Service (OOM Crash)
• Exploit Status: Proof-of-Concept Available
• KEV Status: Not Listed

Affected Systems

• elixir-grpc/grpc (Hex package 'grpc')
• grpc: >= 0.4.0, < 1.0.0 (Fixed in: 1.0.0)

Code Analysis

Commit: 1afbab9

Fix decompression vulnerability by processing streams in chunks and validating decompressed size dynamically.

--- a/lib/grpc/compressor/gzip.ex
+++ b/lib/grpc/compressor/gzip.ex
@@ -1,13 +1,41 @@
 defmodule GRPC.Compressor.Gzip do
   @behaviour GRPC.Compressor

+  @default_max_decompressed_size 4 * 1024 * 1024
+  @input_chunk_size 8_192
+
   def name do
     "gzip"
   end

   def compress(data) do
     :zlib.gzip(data)
   end

   def decompress(data) do
-    :zlib.gunzip(data)
+    max_size =
+      Application.get_env(:grpc, :max_decompressed_message_length, @default_max_decompressed_size)
+
+    z = :zlib.open()
+    :ok = :zlib.inflateInit(z, 31)
+
+    try do
+      chunks = inflate_chunks(z, data, max_size, 0, [])
+      :zlib.inflateEnd(z)
+      IO.iodata_to_binary(chunks)
+    after
+      :zlib.close(z)
+    end
+  end
+
+  defp inflate_chunks(_z, <<>>, _max_size, _acc_size, acc), do: acc
+
+  defp inflate_chunks(z, data, max_size, acc_size, acc) do
+    {chunk, rest} = split_chunk(data)
+    output = :zlib.inflate(z, chunk)
+    new_size = acc_size + IO.iodata_length(output)
+
+    if new_size > max_size do
+      raise GRPC.RPCError,
+        status: :resource_exhausted,
+        message: "Decompressed message exceeds limit of #{max_size} bytes"
+    end
+
+    inflate_chunks(z, rest, max_size, new_size, [acc, output])
+  end

Exploit Details

• GitHub: Reproduction test cases verifying resource exhaustion behavior on decompression bombs are implemented in the official test framework.

Mitigation Strategies

• Upgrade the elixir-grpc dependency to version 1.0.0 or higher.
• Transition monolithic :grpc dependency configurations to use the modular :grpc_server package.
• Apply restrictive request body size limits at the ingress load balancer or reverse proxy layer.
• Limit concurrent HTTP/2 streams per connection to prevent parallel decompression attacks.

Remediation Steps:

1. Locate the mix.exs configuration file within the Elixir application.
2. Update the gRPC dependency declarations to target the secure v1.0 releases, using the :grpc_server package.
3. In corporate configuration files (e.g., config/config.exs), explicitly define the :max_decompressed_message_length parameter to enforce strict limits.
4. Deploy the updated codebase to staging environments and execute unit tests containing compression payloads to verify safe termination.

References

• Official Erlef Advisory Page
• GitHub Security Advisory (GHSA-6ccx-9c9f-327w)
• Official Fix Commit
• OSV Vulnerability Entry
• MITRE CVE Record
• NIST National Vulnerability Database

---

Read the full report for CVE-2026-53430 on our website for more details including interactive diagrams and full exploit analysis.