CVE-2026-53430
grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1
Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb. This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2. 'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill. This issue affects grpc: from 0.4.0 before 1.0.0.
INFO
Published Date :
June 15, 2026, 11:16 p.m.
Last Modified :
Oct. 25, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | HIGH | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update the elixir-grpc library to a non-vulnerable version.
- Apply patches that limit decompressed data size.
- Implement decompression ratio checks.
- Enforce incremental decoding for compressed data.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53430.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53430 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53430
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53430 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53430 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: grpc de elixir-grpc, Description: Manejo Inadecuado de Datos Altamente Comprimidos (Amplificación de Datos) vulnerabilidad en elixir-grpc grpc (módulos GRPC.Compressor.Gzip, GRPC.Message) permite una denegación de servicio a través de una bomba de descompresión gzip. Esta vulnerabilidad está asociada con los archivos de programa lib/grpc/compressor/gzip.ex, lib/grpc/message.ex y las rutinas de programa ’Elixir.GRPC.Compressor.Gzip’:decompress/1, ’Elixir.GRPC.Message’:from_data/2. ’Elixir.GRPC.Compressor.Gzip’:decompress/1 llama a :zlib.gunzip/1 directamente sobre bytes controlados por el atacante sin límite de tamaño descomprimido, verificación de relación o decodificación incremental. Debido a que este módulo es la implementación registrada de gzip GRPC.Compressor, se invoca automáticamente cada vez que una trama gRPC entrante lleva el encabezado grpc-encoding: gzip. :zlib.gunzip/1 asigna el resultado descomprimido completo como un único binario, por lo que una pequeña carga útil altamente compresible (por ejemplo, unos pocos kilobytes de ceros, que gzip comprime aproximadamente a 1000:1) se expande a múltiples gigabytes dentro de una sola llamada. El límite max_receive_message_length se aplica solo contra el mensaje ya descomprimido, por lo que no proporciona protección. Un par remoto no autenticado puede enviar una única trama manipulada para agotar el heap del nodo BEAM y desencadenar una terminación por falta de memoria. Este problema afecta a grpc: desde 0.4.0 antes de 1.0.0. -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-grpc/grpc', 'vendor': 'elixir-grpc', 'modules': ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], 'product': 'grpc', 'versions': [{'status': 'affected', 'version': '0.4.0', 'lessThan': '1.0.0', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/grpc', 'packageName': 'grpc', 'programFiles': ['lib/grpc/compressor/gzip.ex', 'lib/grpc/message.ex'], 'collectionURL': 'https://hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {'name': "'Elixir.GRPC.Message':from_data/2"}]}, {'cpes': ['cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-grpc/grpc', 'vendor': 'elixir-grpc', 'modules': ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], 'product': 'grpc', 'versions': [{'status': 'affected', 'version': 'beae6800fc8baf126f3fe7107d86a50e105275ba', 'lessThan': '1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc', 'versionType': 'git'}], 'packageURL': 'pkg:github/elixir-grpc/grpc', 'packageName': 'elixir-grpc/grpc', 'programFiles': ['lib/grpc/compressor/gzip.ex', 'lib/grpc/message.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {'name': "'Elixir.GRPC.Message':from_data/2"}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-53430', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-16T14:42:39.467618Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 16, 2026
Action Type Old Value New Value Added Reference https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 15, 2026
Action Type Old Value New Value Added Description Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb. This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2. 'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill. This issue affects grpc: from 0.4.0 before 1.0.0. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-409 Added Reference https://cna.erlef.org/cves/CVE-2026-53430.html Added Reference https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc Added Reference https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-53430