CVE-2026-53430

@@ -1,6 +1,14 @@
 defmodule GRPC.Compressor.Gzip do
   @behaviour GRPC.Compressor
 
+  # 4 MB – matches gRPC-Go's default max receive message size.
+  # Override with: Application.put_env(:grpc, :max_decompressed_message_length, bytes)
+  @default_max_decompressed_size 4 * 1024 * 1024
+
+  # Feed compressed input in 8 KB slices so we can detect an oversized output
+  # before allocating the full decompressed payload.
+  @input_chunk_size 8_192
+
   def name do
     "gzip"
   end
@@ -10,6 +18,39 @@ defmodule GRPC.Compressor.Gzip do
   end
 
   def decompress(data) do
-    :zlib.gunzip(data)
+    max_size =
+      Application.get_env(:grpc, :max_decompressed_message_length, @default_max_decompressed_size)
+
+    z = :zlib.open()
+    # windowBits 31 = 15 (max window) + 16 (gzip format flag)
+    :ok = :zlib.inflateInit(z, 31)
+
+    try do
+      chunks = inflate_chunks(z, data, max_size, 0, [])
+      :zlib.inflateEnd(z)
+      IO.iodata_to_binary(chunks)
+    after
+      :zlib.close(z)
+    end
   end
+
+  defp inflate_chunks(_z, <<>>, _max_size, _acc_size, acc), do: acc
+
+  defp inflate_chunks(z, data, max_size, acc_size, acc) do
+    {chunk, rest} = split_chunk(data)
+    output = :zlib.inflate(z, chunk)
+    new_size = acc_size + IO.iodata_length(output)
+
+    if new_size > max_size do
+      raise GRPC.RPCError,
+        status: :resource_exhausted,
+        message: "Decompressed message exceeds limit of #{max_size} bytes"
+    end
+
+    inflate_chunks(z, rest, max_size, new_size, [acc, output])
+  end
+
+  defp split_chunk(data) when byte_size(data) <= @input_chunk_size, do: {data, <<>>}
+
+  defp split_chunk(<<chunk::bytes-size(@input_chunk_size), rest::binary>>), do: {chunk, rest}
 end

@@ -0,0 +1,50 @@
+defmodule GRPC.Compressor.GzipTest do
+  use ExUnit.Case, async: true
+
+  alias GRPC.Compressor.Gzip
+
+  test "round-trips small payloads correctly" do
+    data = String.duplicate("hello world ", 50)
+    assert Gzip.decompress(Gzip.compress(data)) == data
+  end
+
+  test "raises GRPC.RPCError :resource_exhausted on decompression bomb" do
+    # Build a small gzip payload that decompresses to 2x the default 4 MB limit.
+    bomb_size = 9 * 1024 * 1024
+    compressed = :zlib.gzip(:binary.copy(<<0>>, bomb_size))
+
+    assert_raise GRPC.RPCError, ~r/exceeds limit/, fn ->
+      Gzip.decompress(compressed)
+    end
+  end
+
+  test "respects :max_decompressed_message_length application env" do
+    # Temporarily lower the limit to 1 KB.
+    Application.put_env(:grpc, :max_decompressed_message_length, 1024)
+
+    on_exit(fn ->
+      Application.delete_env(:grpc, :max_decompressed_message_length)
+    end)
+
+    oversized = :zlib.gzip(:binary.copy(<<0>>, 2048))
+
+    assert_raise GRPC.RPCError, ~r/exceeds limit/, fn ->
+      Gzip.decompress(oversized)
+    end
+  end
+
+  test "accepts payload exactly at the configured limit" do
+    limit = 4096
+    Application.put_env(:grpc, :max_decompressed_message_length, limit)
+
+    on_exit(fn ->
+      Application.delete_env(:grpc, :max_decompressed_message_length)
+    end)
+
+    # Use incompressible data so the decompressed size is exactly `limit`.
+    data = :crypto.strong_rand_bytes(limit)
+    compressed = :zlib.gzip(data)
+
+    assert Gzip.decompress(compressed) == data
+  end
+end