CVE-2026-53430 is a denial of service vulnerability in elixir-grpc grpc affecting versions from 0.4.0 before 1.0.0. The vulnerability is due to improper handling of highly compressed data in the GRPC.Compressor.Gzip and GRPC.Message modules. Specifically, the decompress/1 function calls :zlib.gunzip/1 on attacker-controlled input without any decompressed size limit or compression ratio checks. This allows a crafted gzip payload to expand massively in memory (a decompression bomb), exhausting the BEAM node's heap and causing an out-of-memory kill. The existing max_receive_message_length limit does not prevent this because it is enforced after decompression.

An unauthenticated remote attacker can send a single specially crafted gRPC frame with gzip encoding that decompresses into a very large payload, causing excessive memory consumption and crashing the BEAM node hosting the grpc service. This results in a denial of service condition. There is no indication of code execution or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, consider implementing external protections such as limiting incoming message sizes at the network level or disabling gzip compression if feasible. Monitor vendor channels for updates and apply official patches once released.