Hex/grpc CVE-2026-53430: high 8.7, EPSS 0.43%
gRPC Erlang package has unbounded gzip decompression (decompression bomb)
Action: Upgrade grpc to 1.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.4.0 | 1.0.0 | - |
Fixed versions
| 1.0.0 |
Sources
- osv: GHSA-6ccx-9c9f-327w
- nvd: CVE-2026-53430
- https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w
- https://github.com/elixir-grpc/grpc/pull/543
- https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc
- https://cna.erlef.org/cves/CVE-2026-53430.html
- https://github.com/elixir-grpc/grpc
- https://github.com/elixir-grpc/grpc/releases/tag/v1.0.0
- https://osv.dev/vulnerability/EEF-CVE-2026-53430
CVE-2026-53430 · published · modified · JSON