CVE-2026-71397 is a high-severity vulnerability in elixir-grpc grpc_server versions from 1.0.0 up to but not including 1.0.6. It allows unauthenticated attackers to exhaust server memory and crash the node by sending oversized client-streaming or bidirectional-streaming request bodies. The vulnerability arises because the streaming read path does not enforce the configured maximum body size, leading to unbounded buffering of incoming data.