CVE-2026-123635

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123635", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-11-09T22:27:54.995Z", "datePublished": "2026-11-13T15:40:16.288Z", "dateUpdated": "2026-11-13T15:40:16.288Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["grpc_stream_h"], "packageName": "grpc_server", "packageURL": "pkg:hex/grpc_server", "product": "grpc_server", "programFiles": ["src/grpc_stream_h.erl"], "programRoutines": [{"name": "grpc_stream_h:init/3"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["grpc_stream_h"], "packageName": "elixir-grpc/grpc", "packageURL": "pkg:github/elixir-grpc/grpc", "product": "grpc_server", "programFiles": ["grpc_server/src/grpc_stream_h.erl"], "programRoutines": [{"name": "grpc_stream_h:init/3"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "61a71948e6e7b95efb27d48e7084c764503cc802", "status": "affected", "version": "0332faae5f5e132314794dbfdae5edecbccea292", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel.</p>"}, {"base64": false, "type": "text/markdown", "value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."}], "value": "Calls from more than one caller must share one HTTP/2 connection to the server, for example through a proxy or a shared client channel."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.1.0", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Aaron Lovi"}, {"lang": "en", "type": "finder", "value": "Aaron Lovi"}, {"lang": "en", "type": "remediation developer", "value": "Paulo Valente"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "dateAssigned": "2026-11-12T20:33:14.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.</p>\n<p>The stream handler <code>grpc_stream_h</code> (<code>grpc_server/src/grpc_stream_h.erl</code>) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds <code>max_body_size</code> or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.</p>\n<p>This issue affects grpc_server: from 1.0.0 before 1.1.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler `grpc_stream_h` (`grpc_server/src/grpc_stream_h.erl`) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds `max_body_size` or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."}], "value": "Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight.\n\nThe stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."}], "impacts": [{"capecId": "CAPEC-131", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally.</p>"}, {"base64": false, "type": "text/markdown", "value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."}], "value": "A client whose calls share an HTTP/2 connection with other callers can make all later calls on that connection wait until their deadlines. Calls on other connections are served normally."}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-772", "description": "CWE-772 Missing Release of Resource after Effective Lifetime", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-13T15:40:16.288Z"}, "references": [{"name": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server", "tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr"}, {"name": "EEF CNA record for CVE-2026-123635", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-123635.html"}, {"name": "OSV record EEF-CVE-2026-123635", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-123635"}, {"name": "Introducing commit 0332faa in elixir-grpc/grpc", "tags": ["related"], "url": "https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"}, {"name": "Fix commit 61a7194 in elixir-grpc/grpc", "tags": ["patch"], "url": "https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802"}], "source": {"discovery": "EXTERNAL"}, "title": "Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Put a Cowboy stream handler in front of <code>grpc_stream_h</code> with the adapter option <code>stream_handlers: [MyHandler, :grpc_stream_h]</code>. In <code>init/3</code>, the handler calls <code>:cowboy_stream.init/3</code> and adds a <code>{:flow, size}</code> command when the request has a body, where <code>size</code> is Cowboy's <code>max_frame_size_received</code> (16384 by default). It passes all other callbacks to <code>:cowboy_stream</code>.</p>"}, {"base64": false, "type": "text/markdown", "value": "Put a Cowboy stream handler in front of `grpc_stream_h` with the adapter option `stream_handlers: [MyHandler, :grpc_stream_h]`. In `init/3`, the handler calls `:cowboy_stream.init/3` and adds a `{:flow, size}` command when the request has a body, where `size` is Cowboy's `max_frame_size_received` (16384 by default). It passes all other callbacks to `:cowboy_stream`."}], "value": "Put a Cowboy stream handler in front of grpc_stream_h with the adapter option stream_handlers: [MyHandler, :grpc_stream_h]. In init/3, the handler calls :cowboy_stream.init/3 and adds a {:flow, size} command when the request has a body, where size is Cowboy's max_frame_size_received (16384 by default). It passes all other callbacks to :cowboy_stream."}], "x_proofOfConcept": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ol>\n<li>Start a gRPC server with a small <code>max_body_size</code>, for example 1000 bytes.</li>\n<li>Open one HTTP/2 connection with a client that tracks the connection window.</li>\n<li>Send a unary call with a body above the limit and wait for the <code>RESOURCE_EXHAUSTED</code> reply.</li>\n<li>Send more DATA frames on the refused stream, up to what the stream and connection windows allow.</li>\n<li>Repeat steps 3 and 4 on new streams until the connection window is 0.</li>\n<li>Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline.</li>\n</ol>"}, {"base64": false, "type": "text/markdown", "value": "1. Start a gRPC server with a small `max_body_size`, for example 1000 bytes.\n2. Open one HTTP/2 connection with a client that tracks the connection window.\n3. Send a unary call with a body above the limit and wait for the `RESOURCE_EXHAUSTED` reply.\n4. Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n5. Repeat steps 3 and 4 on new streams until the connection window is 0.\n6. Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."}], "value": "* Start a gRPC server with a small max_body_size, for example 1000 bytes.\n* Open one HTTP/2 connection with a client that tracks the connection window.\n* Send a unary call with a body above the limit and wait for the RESOURCE_EXHAUSTED reply.\n* Send more DATA frames on the refused stream, up to what the stream and connection windows allow.\n* Repeat steps 3 and 4 on new streams until the connection window is 0.\n* Send a small valid unary call on the same connection. Observe that its body cannot be sent and that the call ends at its deadline."}], "x_technicalAnalysis": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>1. Flow is requested only for data that arrived</strong></p>\n<p>Cowboy increases the HTTP/2 connection window only when a stream handler returns a <code>{flow, N}</code> command. <code>grpc_stream_h</code> returns that command only for request data it has received.</p>\n<p><strong>2. A refused call leaves data uncredited</strong></p>\n<p>When the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level <code>WINDOW_UPDATE</code> is sent.</p>\n<p><strong>3. The window empties</strong></p>\n<p>Each refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.</p>\n<p><strong>4. Result</strong></p>\n<p>Every later call on the connection that has a request body waits until its deadline. A new connection works normally.</p>"}, {"base64": false, "type": "text/markdown", "value": "**1. Flow is requested only for data that arrived**\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a `{flow, N}` command. `grpc_stream_h` returns that command only for request data it has received.\n\n**2. A refused call leaves data uncredited**\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level `WINDOW_UPDATE` is sent.\n\n**3. The window empties**\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n**4. Result**\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."}], "value": "1. Flow is requested only for data that arrived\n\nCowboy increases the HTTP/2 connection window only when a stream handler returns a {flow, N} command. grpc_stream_h returns that command only for request data it has received.\n\n2. A refused call leaves data uncredited\n\nWhen the server refuses a call, the stream stops. The client can still have DATA frames in flight for it. Cowboy drops those frames without running the handler, so no flow is requested for their bytes and no connection-level WINDOW_UPDATE is sent.\n\n3. The window empties\n\nEach refused call with DATA in flight reduces the connection window for good. With the default 65,535-byte window, the window was empty after two refused calls in a test against v1.0.6. An empty window stops all request data, so no handler requests flow again and the window stays empty.\n\n4. Result\n\nEvery later call on the connection that has a request body waits until its deadline. A new connection works normally."}]}}}

{}

{}

{}

{}