Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc_CVE-2026-48853

{
    "lastseen": "",
    "description": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc from 0.4.0 before 1.0.0.",
    "published": "2026-06-15T21:56:15.262Z",
    "modified": "2026-06-15T21:56:15.262Z",
    "type": "cve",
    "title": "Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc",
    "source": "EEF",
    "references": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h\nhttps://cna.erlef.org/cves/CVE-2026-48853.html\nhttps://osv.dev/vulnerability/EEF-CVE-2026-48853\nhttps://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992",
    "id": "CVE-2026-48853",
    "bulletinFamily": "",
    "cwe": [
        "CWE-502",
        "CWE-770"
    ],
    "cvelist": null,
    "sourceData": "elixir-grpc grpc 0.4.0\nelixir-grpc grpc 25bcc569fe2cc4478531a6c546c923205fc751c9",
    "sourceHref": "",
    "cvss": {
        "score": 9.2,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "grpc",
    "version": "0.4.0",
    "vendor": "elixir-grpc",
    "ai_description": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and achieve remote code execution on the server",
    "ai_severity": "Critical",
    "ai_vendor": "Elixir-GRPC",
    "ai_product": "grpc",
    "ai_version": "0.4.0",
    "ai_score": 9.2
}