Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
## Summary Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. `'Elixir.GRPC.Codec.Erlpack':decode/2` (`lib/grpc/codec/erlpack.ex`) calls `:erlang.binary_to_term/1` on the raw gRPC message body without the `:safe` option, no size bound, and no type guard. Any unauthenticated peer that sends a request with `Content-Type: application/grpc+erlpack` can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0. ## Configurations `GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server.
EEF-CVE-2026-48853
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:EEF-CVE-2026-48853
grpc
Source reference: /affected/0/package/name
- Affected versions
- 0.10.0
Source reference:
/affected/0/versions0.10.1Source reference:
/affected/0/versions0.10.2Source reference:
/affected/0/versions0.11.0Source reference:
/affected/0/versions0.11.1Source reference:
/affected/0/versions0.11.2Source reference:
/affected/0/versions0.11.3Source reference:
/affected/0/versions0.11.4Source reference:
/affected/0/versions0.11.5Source reference:
/affected/0/versions0.5.0Source reference:
/affected/0/versions0.5.0-betaSource reference:
/affected/0/versions0.5.0-beta.1Source reference:
/affected/0/versions0.6.0Source reference:
/affected/0/versions0.7.0Source reference:
/affected/0/versions0.8.0Source reference:
/affected/0/versions0.8.1Source reference:
/affected/0/versions0.9.0Source reference:
/affected/0/versions1.0.0-rc.1Source reference:
/affected/0/versions - Fixed versions
- 1.0.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.4.0"
},
{
"fixed": "1.0.0"
}
]
}
],
"package": {
"name": "grpc",
"purl": "pkg:hex/grpc",
"ecosystem": "Hex"
},
"versions": [
"0.10.0",
"0.10.1",
"0.10.2",
"0.11.0",
"0.11.1",
"0.11.2",
"0.11.3",
"0.11.4",
"0.11.5",
"0.5.0",
"0.5.0-beta",
"0.5.0-beta.1",
"0.6.0",
"0.7.0",
"0.8.0",
"0.8.1",
"0.9.0",
"1.0.0-rc.1"
],
"database_specific": {
"source": "https://cna.erlef.org/osv/EEF-CVE-2026-48853.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/elixir-grpc/grpc",
"type": "GIT",
"events": [
{
"introduced": "25bcc569fe2cc4478531a6c546c923205fc751c9"
},
{
"fixed": "272a97a5ea1b46af1819f14a831fcf35fc91f992"
}
]
}
],
"database_specific": {
"source": "https://cna.erlef.org/osv/EEF-CVE-2026-48853.json"
}
}
]- Related CVEs
- CVE-2026-48853
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #14318 · Revision 1
- Added to Heist Feed
- Publisher date