CVE-2026-123635

Description

Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.

Is your site exposed to CVE-2026-123635?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-772 CWE-772

References

Other References

https://cna.erlef.org/cves/CVE-2026-123635.html https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292 https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802 https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr https://osv.dev/vulnerability/EEF-CVE-2026-123635

Frequently Asked Questions

What is CVE-2026-123635? +

Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.

How do I check if I'm vulnerable to CVE-2026-123635? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-104112

A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel …

CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial …

CVE-2026-112200

P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected …

CVE-2026-127124

P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity …

CVE-2026-115793

P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or …

CVE-2026-95108

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The …