CVE-2026-48853: Remote Code Execution and Denial of Service in elixir-grpc Package
Summary
CVE-2026-48853: Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc. Affects grpc across 2 version ranges.
>= 0.4.0, < 1.0.0
>= 25bcc569fe2cc4478531a6c546c923205fc751c9, < 272a97a5ea1b46af1819f14a831fcf35fc91f992
Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elixir-grpc package is a gRPC implementation for Elixir, enabling developers to build efficient and scalable microservices. It allows for seamless communication between services using the gRPC protocol. However, it has been found to be vulnerable to unsafe Erlang term deserialization, which can lead to severe security issues.
Vulnerability Detail
The vulnerability stems from the deserialization of untrusted data in the elixir-grpc package. Specifically, the function 'Elixir.GRPC.Codec.Erlpack:decode/2' calls ':erlang.binary_to_term/1' on raw gRPC message bodies without proper safety measures, such as the :safe option, size limits, or type guards. This oversight allows unauthenticated attackers to send crafted payloads that can mint arbitrary new atoms, leading to atom table exhaustion and crashing the BEAM node. Furthermore, if a decoded term is invoked, it can execute arbitrary code on the server, resulting in remote code execution.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'GRPC.Codec.Erlpack' codec in your gRPC server configuration until you can update to the patched version. This can be done by not registering it as a codec or by using a different codec that does not have this vulnerability.
Conclusion
The elixir-grpc package has a critical vulnerability (CVE-2026-48853) that allows for remote code execution and denial of service due to unsafe deserialization practices. It is crucial to update to version 1.0.0 or later to mitigate this risk. Utilize Vulert to monitor your applications for vulnerabilities in real-time.
See every vulnerability recorded for grpc →
FAQ
CVE-2026-48853 is a vulnerability in the elixir-grpc package that allows for remote code execution and denial of service due to unsafe Erlang term deserialization.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The consequences include potential remote code execution on the server and denial of service due to atom table exhaustion, which can crash the BEAM node.
If you cannot update the package immediately, consider using a different codec that does not have this vulnerability as a temporary workaround.
The CVSS score for this vulnerability is 9.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
