CVE-2026-123635

Description

Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.

Is your site exposed to CVE-2026-123635?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-772 CWE-772

References

Other References

https://cna.erlef.org/cves/CVE-2026-123635.html https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292 https://github.com/elixir-grpc/grpc/commit/61a71948e6e7b95efb27d48e7084c764503cc802 https://github.com/elixir-grpc/grpc/security/advisories/GHSA-7x9q-vvph-rjcr https://osv.dev/vulnerability/EEF-CVE-2026-123635

Frequently Asked Questions

What is CVE-2026-123635? +

Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler grpc_stream_h (grpc_server/src/grpc_stream_h.erl) requests flow from Cowboy only for request data that has arrived. When the server refuses a call early, for example because the body exceeds max_body_size or the method is not implemented, Cowboy drops the DATA frames still in flight for that stream. Their bytes are not returned to the connection flow-control window. After enough refused calls the window is empty. No call on that connection can then send a request body, and each call waits until its deadline. Other connections are not affected. This issue affects grpc_server: from 1.0.0 before 1.1.0.

How do I check if I'm vulnerable to CVE-2026-123635? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-93926

Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This …

CVE-2026-112200

P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected …

CVE-2026-104112

A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel …

CVE-2026-59951

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 …

CVE-2025-3864

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit …

CVE-2025-65947

thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are …