elixir-grpc 0.x erlpack.ex deserialization

Summaryinfo

A vulnerability categorized as critical has been discovered in elixir-grpc grpc 0.x. Impacted is an unknown function of the file lib/grpc/codec/erlpack.ex. The manipulation results in deserialization. This vulnerability is known as CVE-2026-48853. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in elixir-grpc grpc 0.x. Affected is an unknown functionality of the file lib/grpc/codec/erlpack.ex. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc from 0.4.0 before 1.0.0.

The weakness was published by Peter Ullrich and Jonatan Männchen as GHSA-grp7-v8xh-rj7h. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-48853 since 05/25/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.0.0 eliminates this vulnerability. Applying the patch 272a97a5ea1b46af1819f14a831fcf35fc91f992 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• elixir-grpc

Name

• grpc

Version

• 0.x

License

• open-source

Website

• Product: https://github.com/elixir-grpc/grpc/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion