PT-2026-49533 · Elixir Grpc+1 · Grpc

Jonatan Männchen + 2 · Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-48853

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions grpc versions 0.4.0 through 0.9.x

Description Deserialization of untrusted data and allocation of resources without limits or throttling allow unauthenticated attackers to crash the BEAM node or achieve remote code execution on the server. The function decode/2 in Elixir.GRPC.Codec.Erlpack calls :erlang.binary to term/1 on the raw gRPC message body without the :safe option, size bounds, or type guards. An unauthenticated peer sending a request with Content-Type: application/grpc+erlpack can provide a crafted payload to mint arbitrary new atoms, which are not garbage-collected, leading to atom table exhaustion and a VM crash. Additionally, the payload can encode a fun term that executes attacker-controlled code if applied downstream. This issue occurs when GRPC.Codec.Erlpack is explicitly registered as a codec on the gRPC server.

Recommendations Update to version 1.0.0 or later. As a temporary workaround, avoid registering GRPC.Codec.Erlpack as a codec on the gRPC server.

Fix

Deserialization of Untrusted Data

Allocation of Resources Without Limits

Weakness Enumeration

CWE-502

CWE-770

Related Identifiers

CVE-2026-48853

GHSA-GRP7-V8XH-RJ7H

Affected Products

Grpc

References · 6

• https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992 · Patch
• https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-48853 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48853 · Security Note
• https://hex.pm/packages/grpc · Note
• https://cna.erlef.org/cves/CVE-2026-48853.html · Note