Executive Summary

This vulnerability is an improper handling of highly compressed data (data amplification) in the elixir-grpc grpc library, specifically in the GRPC.Compressor.Gzip and GRPC.Message modules. It allows a denial of service attack via a gzip decompression bomb.

The issue arises because the decompress/1 function calls :zlib.gunzip/1 directly on attacker-controlled compressed data without any limit on decompressed size, ratio checks, or incremental decoding. This means a small compressed payload can expand to multiple gigabytes in memory.

Since the max_receive_message_length limit is only checked after decompression, it does not prevent this attack. An unauthenticated remote attacker can send a single crafted frame with the grpc-encoding: gzip header to exhaust the server's memory and cause an out-of-memory crash.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial of service (DoS) condition by exhausting the memory of the BEAM node running the elixir-grpc grpc service.

An attacker can send a specially crafted compressed message that decompresses into a very large payload, causing the server to allocate excessive memory and potentially crash or become unresponsive.

Because the attack requires no authentication, it can be triggered remotely by any unauthenticated user, making systems using affected versions vulnerable to disruption.

Useful 0 Not Useful 0