CVE-2026-53430

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53430", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-09T11:01:47.529Z", "datePublished": "2026-06-15T21:55:33.707Z", "dateUpdated": "2026-06-17T04:46:39.180Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://hex.pm", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], "packageName": "grpc", "packageURL": "pkg:hex/grpc", "product": "grpc", "programFiles": ["lib/grpc/compressor/gzip.ex", "lib/grpc/message.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {"name": "'Elixir.GRPC.Message':from_data/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1.0.0", "status": "affected", "version": "0.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], "packageName": "elixir-grpc/grpc", "packageURL": "pkg:github/elixir-grpc/grpc", "product": "grpc", "programFiles": ["lib/grpc/compressor/gzip.ex", "lib/grpc/message.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {"name": "'Elixir.GRPC.Message':from_data/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc", "status": "affected", "version": "beae6800fc8baf126f3fe7107d86a50e105275ba", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.0", "versionStartIncluding": "0.4.0", "vulnerable": true}], "negate": false, "operator": "AND"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Paulo Valente"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (<tt>GRPC.Compressor.Gzip</tt>, <tt>GRPC.Message</tt> modules) allows a denial of service via a gzip decompression bomb.</p><p>This vulnerability is associated with program files <tt>lib/grpc/compressor/gzip.ex</tt>, <tt>lib/grpc/message.ex</tt> and program routines <tt>'Elixir.GRPC.Compressor.Gzip':decompress/1</tt>, <tt>'Elixir.GRPC.Message':from_data/2</tt>.</p><p><tt>'Elixir.GRPC.Compressor.Gzip':decompress/1</tt> calls <tt>:zlib.gunzip/1</tt> directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip <tt>GRPC.Compressor</tt> implementation, it is invoked automatically whenever an incoming gRPC frame carries the <tt>grpc-encoding: gzip</tt> header. <tt>:zlib.gunzip/1</tt> allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The <tt>max_receive_message_length</tt> limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.</p><p>This issue affects grpc: from 0.4.0 before 1.0.0.</p>"}], "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.\n\nThis vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2.\n\n'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-06-17T04:46:39.180Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-53430.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53430"}, {"tags": ["patch"], "url": "https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc"}], "source": {"discovery": "EXTERNAL"}, "title": "grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T14:42:39.467618Z", "id": "CVE-2026-53430", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:43:11.143Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53430", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T14:42:39.467618Z"}}}], "references": [{"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:43:02.798Z"}}], "cna": {"title": "grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Paulo Valente"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "modules": ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], "product": "grpc", "versions": [{"status": "affected", "version": "0.4.0", "lessThan": "1.0.0", "versionType": "semver"}], "packageURL": "pkg:hex/grpc", "packageName": "grpc", "programFiles": ["lib/grpc/compressor/gzip.ex", "lib/grpc/message.ex"], "collectionURL": "https://hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {"name": "'Elixir.GRPC.Message':from_data/2"}]}, {"cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "modules": ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], "product": "grpc", "versions": [{"status": "affected", "version": "beae6800fc8baf126f3fe7107d86a50e105275ba", "lessThan": "1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc", "versionType": "git"}], "packageURL": "pkg:github/elixir-grpc/grpc", "packageName": "elixir-grpc/grpc", "programFiles": ["lib/grpc/compressor/gzip.ex", "lib/grpc/message.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {"name": "'Elixir.GRPC.Message':from_data/2"}]}], "references": [{"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-53430.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53430", "tags": ["related"]}, {"url": "https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.\n\nThis vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2.\n\n'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (<tt>GRPC.Compressor.Gzip</tt>, <tt>GRPC.Message</tt> modules) allows a denial of service via a gzip decompression bomb.</p><p>This vulnerability is associated with program files <tt>lib/grpc/compressor/gzip.ex</tt>, <tt>lib/grpc/message.ex</tt> and program routines <tt>'Elixir.GRPC.Compressor.Gzip':decompress/1</tt>, <tt>'Elixir.GRPC.Message':from_data/2</tt>.</p><p><tt>'Elixir.GRPC.Compressor.Gzip':decompress/1</tt> calls <tt>:zlib.gunzip/1</tt> directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip <tt>GRPC.Compressor</tt> implementation, it is invoked automatically whenever an incoming gRPC frame carries the <tt>grpc-encoding: gzip</tt> header. <tt>:zlib.gunzip/1</tt> allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The <tt>max_receive_message_length</tt> limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.</p><p>This issue affects grpc: from 0.4.0 before 1.0.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.0", "versionStartIncluding": "0.4.0"}], "operator": "AND"}], "operator": "OR"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-06-15T21:55:33.707Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53430", "state": "PUBLISHED", "dateUpdated": "2026-06-16T14:43:11.143Z", "dateReserved": "2026-06-09T11:01:47.529Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-15T21:55:33.707Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://hex.pm", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], "packageName": "grpc", "packageURL": "pkg:hex/grpc", "product": "grpc", "programFiles": ["lib/grpc/compressor/gzip.ex", "lib/grpc/message.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {"name": "'Elixir.GRPC.Message':from_data/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1.0.0", "status": "affected", "version": "0.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Compressor.Gzip'", "'Elixir.GRPC.Message'"], "packageName": "elixir-grpc/grpc", "packageURL": "pkg:github/elixir-grpc/grpc", "product": "grpc", "programFiles": ["lib/grpc/compressor/gzip.ex", "lib/grpc/message.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Compressor.Gzip':decompress/1"}, {"name": "'Elixir.GRPC.Message':from_data/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc", "status": "affected", "version": "beae6800fc8baf126f3fe7107d86a50e105275ba", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb.\n\nThis vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2.\n\n'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."}, {"lang": "es", "value": "Manejo Inadecuado de Datos Altamente Comprimidos (Amplificaci\u00f3n de Datos) vulnerabilidad en elixir-grpc grpc (m\u00f3dulos GRPC.Compressor.Gzip, GRPC.Message) permite una denegaci\u00f3n de servicio a trav\u00e9s de una bomba de descompresi\u00f3n gzip.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/grpc/compressor/gzip.ex, lib/grpc/message.ex y las rutinas de programa \u2019Elixir.GRPC.Compressor.Gzip\u2019:decompress/1, \u2019Elixir.GRPC.Message\u2019:from_data/2.\n\n\u2019Elixir.GRPC.Compressor.Gzip\u2019:decompress/1 llama a :zlib.gunzip/1 directamente sobre bytes controlados por el atacante sin l\u00edmite de tama\u00f1o descomprimido, verificaci\u00f3n de relaci\u00f3n o decodificaci\u00f3n incremental. Debido a que este m\u00f3dulo es la implementaci\u00f3n registrada de gzip GRPC.Compressor, se invoca autom\u00e1ticamente cada vez que una trama gRPC entrante lleva el encabezado grpc-encoding: gzip. :zlib.gunzip/1 asigna el resultado descomprimido completo como un \u00fanico binario, por lo que una peque\u00f1a carga \u00fatil altamente compresible (por ejemplo, unos pocos kilobytes de ceros, que gzip comprime aproximadamente a 1000:1) se expande a m\u00faltiples gigabytes dentro de una sola llamada. El l\u00edmite max_receive_message_length se aplica solo contra el mensaje ya descomprimido, por lo que no proporciona protecci\u00f3n. Un par remoto no autenticado puede enviar una \u00fanica trama manipulada para agotar el heap del nodo BEAM y desencadenar una terminaci\u00f3n por falta de memoria.\n\nEste problema afecta a grpc: desde 0.4.0 antes de 1.0.0."}], "id": "CVE-2026-53430", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53430", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-16T14:42:39.467618Z", "version": "2.0.3"}}]}, "published": "2026-06-15T23:16:46.363", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-53430.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53430"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,1.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[beae6800fc8baf126f3fe7107d86a50e105275ba,1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "grpc", "vendor": "elixir-grpc"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,1.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grpc", "source": "cna", "vendor": "elixir-grpc"}, "product": "grpc", "vendor": "elixir-grpc"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[beae6800fc8baf126f3fe7107d86a50e105275ba,1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grpc", "source": "cna", "vendor": "elixir-grpc"}, "product": "grpc", "vendor": "elixir-grpc"}], "created": "2026-06-16T04:00:15.652252+00:00", "updated": "2026-06-17T23:00:14.706322+00:00", "vendors": ["elixir-grpc", "elixir-grpc$PRODUCT$grpc"]}