CVE-2026-124279

{
  "etk_id": "ETK-2026-4406",
  "cve_id": "CVE-2026-124279",
  "display_id": "CVE-2026-124279",
  "ghsa_id": "GHSA-736x-r87j-jhcm",
  "euvd_id": "EUVD-2026-125543",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Memory exhaustion in grpc_server streaming request handling",
  "summary": "grpc_server versions 1.0.0 through 1.0.x before 1.1.0 do not safely bound memory used for streaming RPC request bodies. An unauthenticated remote client can cause excessive server memory use and potentially disrupt service by sending client-streaming or bidirectional-streaming requests. Exposure requires a reachable server that accepts those streaming RPCs.",
  "mitigation": "Upgrade grpc_server to version 1.1.0 or later. If consuming the elixir-grpc/grpc package directly, update to commit b1e771d558941b1ed4b6de8b39f6a5375543db01 or a later release containing it.",
  "vendor": "elixir-grpc",
  "product": "grpc_server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.0, < 1.1.0"
      ],
      "ecosystem": "erlang",
      "fixed_versions": [
        "1.1.0"
      ],
      "package_name": "grpc_server",
      "purl": "pkg:hex/grpc_server"
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 16.846293566666667,
  "t0_at": "2026-11-13T16:18:56.700000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-13T17:29:41.310873+00:00",
      "days": 0.04912744065972222,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T16:18:56.700000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-13T16:18:56.700000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T16:18:56.700000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-124279"
    }
  }
}