THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-q8gf-9rvj-gmgj (high) — gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

[GHSA] GHSA-q8gf-9rvj-gmgj (high) — gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

highgithub_advisoriesPublished 2026-08-25

GHSA-q8gf-9rvj-gmgj Severity: high CVE: CVE-2026-48854

gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

### Summary

`'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3` accumulates every received chunk into a single growing binary with no size cap. When the client omits the `grpc-timeout` header, the read timeout resolves to `:infinity`, allowing a sl

Indicators of compromise

Original source: https://github.com/advisories/GHSA-q8gf-9rvj-gmgj