CVE-2026-48853

published 2026-06-15

CVE-2026-48853: Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers…

Priority P2 68 critical 9.2 CVSS 4.0

AV N AC L AT P PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.

'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.

This issue affects grpc from 0.4.0 before 1.0.0.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
elixir-grpc	grpc	>= 0.4.0 < 1.0.0	1.0.0
elixir-grpc	grpc	>= 25bcc569fe2cc4478531a6c546c923205fc751c9 < 272a97a5ea1b46af1819f14a831fcf35fc91f992	272a97a5ea1b46af1819f14a831fcf35fc91f992

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502 CWE-770