Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution, Denial of service
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502 and CWE-770.
Summary
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elixir-grpc | grpc | 0.4.0 to before 1.0.0 | 1.0.0 | Patch available | CNA |
| — | grpc (Hex) | 0.4.0 to before 1.0.0 | 1.0.0 | Patch available | GHSA-grp7-v8xh-rj7h |
- grpc Vendorelixir-grpc Affected 0.4.0 to before 1.0.0 Fixed in 1.0.0 Patch available CNA
- grpc (Hex) Vendor— Affected 0.4.0 to before 1.0.0 Fixed in 1.0.0 Patch available GHSA-grp7-v8xh-rj7h
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA grpc (elixir-grpc) Fixed in 1.0.0
- Fix · GHSA-grp7-v8xh-rj7h grpc (Hex) Fixed in 1.0.0 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
elixir-grpc grpc 1.0.0
4 records Highest priority Priority HIGH 4 HIGH
Other records, highest priority first
- TI-2026-38512 grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1Priority HIGH 77
- TI-2026-36119 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpcPriority HIGH 77
- TI-2026-35955 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcodingPriority HIGH 68
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48853
- 2026-10-03 Alias added: GHSA-grp7-v8xh-rj7h
References
Advisory 2
More elixir-grpc vulnerabilities
- TI-2026-38512 grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1 CVSS 4.0HIGH 8.7
- TI-2026-36119 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc CVSS 4.0HIGH 8.7
- TI-2026-35955 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding CVSS 4.0HIGH 7.6
- TI-2026-86129 Unbounded streaming request buffering in grpc_server exhausts memory CVSS 4.0HIGH 8.2
Sources
- CVE-2026-48853 · CVE Program
- CVE-2026-48853 · NVD
- FIRST EPSS
- GHSA-grp7-v8xh-rj7h · GitHub Advisory Database · CC BY 4.0
- CVE-2026-48853 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences