Threats affecting pkg:hex/grpc_core

CVE-2026-121808 is a high-severity vulnerability in elixir-grpc's grpc and grpc_core components that improperly handle highly compressed data in gRPC message bodies. The vulnerability arises because the decoding function uses :erlang.binary_to_term/2 without limiting the size of the decompressed data, allowing unauthenticated attackers to send compressed messages that expand to very large terms, exhausting server memory. This affects grpc versions from 0.4.0 up to but not including 1.0.0, and grpc_core versions from 1.0.0 up to but not including 1.1.0. Fixed versions are 1.0.0 for grpc and 1.1.0 for grpc_core.