Skip to content
Heist/ feed
CriticalFix available

Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc

Type: advisorySource: OSV1 source record

## Summary Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. `'Elixir.GRPC.Codec.Erlpack':decode/2` (`lib/grpc/codec/erlpack.ex`) calls `:erlang.binary_to_term/1` on the raw gRPC message body without the `:safe` option, no size bound, and no type guard. Any unauthenticated peer that sends a request with `Content-Type: application/grpc+erlpack` can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0. ## Configurations `GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server.

Announced Source revision 1
Original source ↗

EEF-CVE-2026-48853

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:EEF-CVE-2026-48853

grpc

Source reference: /affected/0/package/name

Affected versions
0.10.0

Source reference: /affected/0/versions

0.10.1

Source reference: /affected/0/versions

0.10.2

Source reference: /affected/0/versions

0.11.0

Source reference: /affected/0/versions

0.11.1

Source reference: /affected/0/versions

0.11.2

Source reference: /affected/0/versions

0.11.3

Source reference: /affected/0/versions

0.11.4

Source reference: /affected/0/versions

0.11.5

Source reference: /affected/0/versions

0.5.0

Source reference: /affected/0/versions

0.5.0-beta

Source reference: /affected/0/versions

0.5.0-beta.1

Source reference: /affected/0/versions

0.6.0

Source reference: /affected/0/versions

0.7.0

Source reference: /affected/0/versions

0.8.0

Source reference: /affected/0/versions

0.8.1

Source reference: /affected/0/versions

0.9.0

Source reference: /affected/0/versions

1.0.0-rc.1

Source reference: /affected/0/versions

Fixed versions
1.0.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0.4.0"
          },
          {
            "fixed": "1.0.0"
          }
        ]
      }
    ],
    "package": {
      "name": "grpc",
      "purl": "pkg:hex/grpc",
      "ecosystem": "Hex"
    },
    "versions": [
      "0.10.0",
      "0.10.1",
      "0.10.2",
      "0.11.0",
      "0.11.1",
      "0.11.2",
      "0.11.3",
      "0.11.4",
      "0.11.5",
      "0.5.0",
      "0.5.0-beta",
      "0.5.0-beta.1",
      "0.6.0",
      "0.7.0",
      "0.8.0",
      "0.8.1",
      "0.9.0",
      "1.0.0-rc.1"
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-48853.json"
    }
  },
  {
    "ranges": [
      {
        "repo": "https://github.com/elixir-grpc/grpc",
        "type": "GIT",
        "events": [
          {
            "introduced": "25bcc569fe2cc4478531a6c546c923205fc751c9"
          },
          {
            "fixed": "272a97a5ea1b46af1819f14a831fcf35fc91f992"
          }
        ]
      }
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-48853.json"
    }
  }
]
Related CVEs
CVE-2026-48853

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-48853 · Critical

grpc, grpc

Event
#14318 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement