HighFix available

Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

Type: advisorySource: OSV1 source record

## Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. `'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3` (`lib/grpc/server/adapters/cowboy/handler.ex`) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the `grpc-timeout` header, the per-chunk read timeout resolves to `:infinity`, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node. This issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.

Announced 15 Jun 2026Group revision 1

Original source ↗

EEF-CVE-2026-48854

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:EEF-CVE-2026-48854

grpc

Source reference: /affected/0/package/name

Affected versions: 0.10.0
Source reference: /affected/0/versions
0.10.1
Source reference: /affected/0/versions
0.10.2
Source reference: /affected/0/versions
0.11.0
Source reference: /affected/0/versions
0.11.1
Source reference: /affected/0/versions
0.11.2
Source reference: /affected/0/versions
0.11.3
Source reference: /affected/0/versions
0.11.4
Source reference: /affected/0/versions
0.11.5
Source reference: /affected/0/versions
0.3.0-alpha.2
Source reference: /affected/0/versions
0.3.1
Source reference: /affected/0/versions
0.4.0-alpha.1
Source reference: /affected/0/versions
0.4.0-alpha.2
Source reference: /affected/0/versions
0.5.0
Source reference: /affected/0/versions
0.5.0-beta
Source reference: /affected/0/versions
0.5.0-beta.1
Source reference: /affected/0/versions
0.6.0
Source reference: /affected/0/versions
0.7.0
Source reference: /affected/0/versions
0.8.0
Source reference: /affected/0/versions
0.8.1
Source reference: /affected/0/versions
0.9.0
Source reference: /affected/0/versions
1.0.0-rc.1
Source reference: /affected/0/versions
Fixed versions: 1.0.0
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0.3.0-alpha.2"
          },
          {
            "fixed": "1.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "grpc",
      "purl": "pkg:hex/grpc",
      "ecosystem": "Hex"
    },
    "versions": [
      "0.10.0",
      "0.10.1",
      "0.10.2",
      "0.11.0",
      "0.11.1",
      "0.11.2",
      "0.11.3",
      "0.11.4",
      "0.11.5",
      "0.3.0-alpha.2",
      "0.3.1",
      "0.4.0-alpha.1",
      "0.4.0-alpha.2",
      "0.5.0",
      "0.5.0-beta",
      "0.5.0-beta.1",
      "0.6.0",
      "0.7.0",
      "0.8.0",
      "0.8.1",
      "0.9.0",
      "1.0.0-rc.1"
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-48854.json"
    }
  },
  {
    "ranges": [
      {
        "repo": "https://github.com/elixir-grpc/grpc",
        "type": "GIT",
        "events": [
          {
            "introduced": "d1abe70a6cad6dac4a3f8235d883d7c896989560"
          },
          {
            "fixed": "49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"
          }
        ]
      }
    ],
    "versions": [
      "v0.11.2",
      "v0.8.1",
      "v0.8.0",
      "v0.7.0",
      "v0.6.0",
      "v0.5.0",
      "v0.5.0-beta.1",
      "v0.5.0-beta",
      "v0.4.0",
      "v0.3.1",
      "v0.3.0-alpha.2"
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-48854.json"
    }
  }
]

Related CVEs: CVE-2026-48854
Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-48854 · High

grpc, grpc

Event: #14320 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:40:06 GMT
Publisher date: Mon, 15 Jun 2026 21:55:23 GMT

Read the original announcement

Revision history

25 Oct 2026EEF-CVE-2026-48854 · Revision 1Source updated