CVE-2026-121808

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2 (grpc_core/lib/grpc/codec/erlpack.ex, and lib/grpc/codec/erlpack.ex before the package split) passes the message body to :erlang.binary_to_term/2. That function inflates a compressed term in full before it returns. The codec sets no limit on the decoded size, and its type checks run only on the decoded term. The server's max_body_size limit counts the compressed bytes of the request. A request with Content-Type: application/grpc+erlpack can therefore make the server allocate a term much larger than the request body. This issue affects grpc: from 0.4.0 before 1.0.0; grpc_core: from 1.0.0 before 1.1.0.

• CWE-409

• https://cna.erlef.org/cves/CVE-2026-121808.html
• https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292
• https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9
• https://github.com/elixir-grpc/grpc/commit/d6bc56ac75dfb6c02db2099909210a37c9be8db6
• https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xxp9-7hp4-rqwp
• https://osv.dev/vulnerability/EEF-CVE-2026-121808

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-121792The GamiPress – Gamification plugin to reward points, badges…6.5
• CVE-2026-121794The Travelly – Tour & Travel Booking Manager for WooCommerce…6.5
• CVE-2026-121796The Add From Server Lite WordPress plugin before 6.0.0 does …6.8
• CVE-2026-1218A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0…6.3
• CVE-2026-121802@better-auth/expo before 1.7.16 allows certain account-takeo…9.1
• CVE-2026-121803Rejected reason: This CVE ID is a duplicate of CVE-2026-8033…
• CVE-2026-121809Loop with Unreachable Exit Condition ('Infinite Loop') vulne…8.2
• CVE-2026-121816Herowatch Mini developed by About Time Technologies has a Mi…8.8
• CVE-2026-121817Herowatch Go Server developed by About Time Technologies has…7.5
• CVE-2026-121818Herowatch Mini developed by About Time Technologies has a sy…7.8
• CVE-2026-121819A vulnerability has been identified in armeria-xds versions …5.9
• CVE-2026-121820A vulnerability has been identified in armeria-saml versions…8.7