CVE-2026-53430 is a denial of service vulnerability in elixir-grpc grpc affecting versions from 0.4.0 before 1.0.0. The vulnerability is due to improper handling of highly compressed data in the GRPC.Compressor.Gzip and GRPC.Message modules. Specifically, the decompress/1 function calls :zlib.gunzip/1 directly on attacker-controlled input without limiting the decompressed size or performing ratio checks. This allows a small compressed payload to expand into a very large decompressed binary, exhausting memory resources and causing the BEAM node to be killed. The max_receive_message_length limit does not mitigate this because it is enforced only after decompression.

An unauthenticated remote attacker can send a single crafted gRPC frame with grpc-encoding: gzip header containing a decompression bomb. This causes the server to allocate excessive memory during decompression, leading to out-of-memory conditions and denial of service by crashing or killing the BEAM node hosting the grpc service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling gzip compression for incoming gRPC messages or implementing external controls to limit message sizes before decompression. Monitor for updates from the elixir-grpc project regarding an official fix.