The vulnerability allows an attacker to send an unbounded request body on client‑streaming or bidirectional‑streaming gRPC calls. Because the grpc_server code does not enforce the configured limit for streaming messages, every chunk received is appended to an internal buffer. An attacker can fragment a very large message over many small HTTP/2 DATA frames, causing the server to accumulate an arbitrarily large amount of data in memory. Once memory consumption rises above the available quota, the Erlang runtime or the operating system will terminate the node, resulting in a denial of service.

The issue is present in the elixir‑grpc grpc_server component. Vulnerable releases are all versions from 1.0.0 up to and including 1.0.5. Versions 1.0.6 and later contain a fix that checks the maximum body size for streaming requests.

The CVSS score is 8.2, indicating a high impact vulnerability. No EPSS value is available, and the flaw has not yet been listed in the CISA KEV catalog. Because the bug accepts unauthenticated input from clients and does not require any special configuration, an attacker with network access to the gRPC endpoint can trigger the exploit by sending a large streaming request. The impact is fatal denial of service through memory exhaustion.