CVE-2026-48853

CriticalCVSS 9.2

Published: 15/06/2026(UTC)Updated: 24/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.78%

54th percentile - higher than 54% of all known CVEs

Summary

The elixir-grpc library (grpc) contains deserialization of untrusted data and allocation of resources without limits or throttling vulnerabilities. An unauthenticated attacker can send a crafted payload with Content-Type: application/grpc+erlpack, causing atom table exhaustion and crashing the BEAM node, and in some cases achieving remote code execution. This affects versions from 0.4.0 before 1.0.0.

Risk Assessment

An unauthenticated attacker can remotely crash the BEAM node (denial of service) or execute arbitrary code in the server context, leading to full compromise. Only the ability to send a gRPC request is required.

Recommendation

Update the grpc library to version 1.0.0 or later. Until patched, consider restricting access to gRPC endpoints or filtering requests with Content-Type: application/grpc+erlpack.

Other vulnerabilities in elixir-grpc

CVE-2026-48854High
The elixir-grpc library in versions from 0.3.0-alpha.2 before 1.0.0 allows unauthenticated attackers to exhaust BEAM memory and crash the server by streaming a large or slow-trickle unary request body. The read_full_body/3 function accumulates all chunks into a single growing binary with no size cap, and a missing grpc-timeout header sets the read timeout to :infinity. A single connection is enough to exhaust memory and crash the node.

Original NVD description (English source)

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS