CVE-2026-48853 Details
Description
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0.
A vulnerability in the elixir-grpc grpc package, specifically in versions 0.4.0 prior to 1.0.0, allows unauthenticated attackers to cause a denial-of-service by exhausting the BEAM node's atom table. This leads to a crash of the entire virtual machine. Additionally, if a decoded term is passed to a call site that executes it, remote code execution can be achieved on the server. The issue arises because the 'Elixir.GRPC.Codec.Erlpack':decode/2 function processes the raw gRPC message body using ':erlang.binary_to_term/1' without the 'safe' option, size restrictions, or type validation. As a result, an unauthenticated peer can send a crafted payload that either creates new atoms, which are not garbage-collected and fill up the atom table, or encodes a function term that, if invoked downstream, executes code controlled by the attacker within the server process.
Update to version 1.0.0 or later, and ensure that 'GRPC.Codec.Erlpack' is not registered as a codec on the gRPC server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 15, 2026CISA-ADP
Assessed Jun 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://cna.erlef.org/cves/CVE-2026-48853.html | EEF | AdvisoryBundle |
| https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9 | EEF | |
| https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992 | EEF | Source CodeVendor |
| https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-48853 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | EEF |
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-grpc | >= 0.4.0, < 1.0.0 (semver) |
CPE
Remediation
| |
| elixir-grpc/grpc | >= 0.4.0, < 1.0.0 (semver) |
CPE
Remediation
| |
| Hex grpc | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | EEF |
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | New CVE Received | EEF |