This vulnerability (CWE-770) in elixir-grpc grpc affects the 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 function, which accumulates every received chunk of a unary request into a single growing binary with no size cap. Additionally, if the client omits the grpc-timeout header, the per-chunk read timeout defaults to :infinity, allowing a slow-trickle client to maintain the connection indefinitely while memory usage grows unchecked. This can lead to exhaustion of the BEAM's memory and crash the server node. The issue affects grpc versions from 0.3.1 up to but not including 1.0.0.

An unauthenticated attacker can exploit this vulnerability to cause a denial of service by exhausting the server's memory resources, leading to a crash of the BEAM node running the grpc server. This disrupts availability of the affected service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external request size limits or timeouts at the network or proxy level to mitigate potential exploitation. Monitor for unusually large or slow-trickle unary requests that could indicate attempts to exploit this vulnerability.