CVE-2026-48854: Memory Exhaustion Vulnerability in elixir-grpc/grpc Due to Unbounded Request Body Accumulation
Summary
CVE-2026-48854: Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc. Affects grpc across 2 version ranges.
>= 0.3.1, < 1.0.0
>= d1abe70a6cad6dac4a3f8235d883d7c896989560, < 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00
Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
elixir-grpc/grpc is a library designed for building gRPC servers in Elixir, enabling efficient communication between services. It leverages the BEAM virtual machine for concurrent processing and fault tolerance. However, the library has a critical vulnerability that allows unauthenticated attackers to exploit memory management, leading to potential server crashes.
Vulnerability Detail
The vulnerability arises from the 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 function, which accumulates incoming request body chunks into a single binary without any size limit. This lack of throttling allows attackers to send large or slow-trickle requests, causing the server's memory to grow uncontrollably. If the grpc-timeout header is omitted by the client, the read timeout becomes infinite, enabling a single connection to exhaust the server's memory and crash the node. This issue affects versions of grpc from 0.3.1 up to, but not including, 1.0.0.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a request body size limit in your application logic to prevent excessive memory usage. For example, you can check the size of the incoming request body and reject requests that exceed a certain threshold.
Conclusion
CVE-2026-48854 is a significant vulnerability in the elixir-grpc/grpc library that can lead to memory exhaustion and server crashes. It is crucial for users of this library to update to version 1.0.0 or later to protect their applications from potential attacks. Additionally, implementing workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for grpc →
FAQ
CVE-2026-48854 is a vulnerability in the elixir-grpc/grpc library that allows attackers to exhaust server memory by sending large or slow-trickle request bodies.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without needing to sign up.
The vulnerability can lead to server crashes due to memory exhaustion, which can disrupt service availability and affect user experience.
Yes, the vulnerability is patched in version 1.0.0 of the grpc package. It is recommended to update to this version or later.
If an immediate update is not possible, implement a request body size limit in your application to mitigate the risk of memory exhaustion.
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
