CVE-2026-53430: grpc Package Gzip Decompression Bomb Vulnerability
Summary
CVE-2026-53430: grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1. Affects grpc across 2 version ranges.
>= 0.4.0, < 1.0.0
>= beae6800fc8baf126f3fe7107d86a50e105275ba, < 1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc
Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The grpc package, utilized in Elixir applications for remote procedure calls, provides efficient communication between services. It supports various compression algorithms, including gzip, to optimize data transmission. However, the package has a critical vulnerability that allows attackers to exploit gzip decompression, leading to potential denial of service.
Vulnerability Detail
The vulnerability arises from improper handling of highly compressed data within the grpc package, specifically in the GRPC.Compressor.Gzip.decompress/1 function. This function directly calls :zlib.gunzip/1 on data controlled by an attacker without any checks on the decompressed size or compression ratio. As a result, a small payload can expand to several gigabytes, exhausting the memory of the BEAM node and causing an out-of-memory kill. This issue affects versions of grpc from 0.4.0 to before 1.0.0, allowing unauthenticated remote peers to send crafted frames that trigger this vulnerability.
How To Fix
Latest published version: 1.0.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a size limit on incoming messages or disable gzip compression for gRPC frames until you can update to the patched version. This can be done by configuring your gRPC server settings to avoid using gzip encoding.
Conclusion
The grpc package has a significant vulnerability related to gzip decompression that can lead to denial of service. It is crucial for developers using this package to update to version 1.0.0 or later to mitigate the risk. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for grpc →
FAQ
A gzip decompression bomb is a maliciously crafted file that, when decompressed, expands to an extremely large size, potentially overwhelming system resources and causing denial of service.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your application without any signup.
Exploiting this vulnerability can lead to denial of service, where the application becomes unresponsive due to memory exhaustion, affecting availability and performance.
Yes, the CVSS score for this vulnerability is 8.7, indicating a high severity level.
If immediate updates are not feasible, consider implementing workarounds such as limiting message sizes or disabling gzip compression until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
