CVE-2026-48854 Details

A vulnerability allowing unbounded memory consumption has been identified in the elixir-grpc grpc library, specifically in versions 0.3.1 prior to 1.0.0. This vulnerability resides within the 'Elixir.GRPC.Server.Adapters.Cowboy.Handler' module, in the 'read_full_body/3' function. The issue allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming large or slow-trickle unary request bodies. The vulnerability arises because the 'read_full_body/3' function accumulates each received chunk into a single binary without any size limit. Furthermore, if the client does not include the 'grpc-timeout' header, the read timeout for each chunk becomes infinite. This combination enables a slow client to keep the connection open indefinitely while the server's memory usage increases. Exploitation can be achieved with a single connection, leading to a denial-of-service condition by exhausting the server's memory and causing the node to crash.

Users can upgrade to elixir-grpc grpc version 1.0.0 or later, where this vulnerability has been fixed.