CVE-2026-48853: gRPC Erlang Package Vulnerable to Remote Code Execution and Denial of Service
Summary
CVE-2026-48853: gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads. Affects grpc versions >= 0.4.0, < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gRPC package for Erlang is a framework that enables remote procedure calls (RPC) using HTTP/2. It allows developers to build efficient and scalable applications by facilitating communication between services. However, versions 0.4.0 and above have a critical vulnerability that exposes servers to potential remote code execution (RCE) and denial of service (DoS) attacks when using the Erlpack codec.
Vulnerability Detail
The vulnerability arises from the GRPC.Codec.Erlpack.decode/2 function, which directly calls :erlang.binary_to_term/1 without the :safe option. This oversight allows unauthenticated attackers to send crafted gRPC payloads that can either exhaust the atom table, leading to a DoS condition, or execute arbitrary code within the server process if a decoded fun term is invoked. The lack of size limits and type validation further exacerbates the risk, making it possible for attackers to manipulate the server's behavior.
How To Fix
Latest published version: 1.0.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid registering GRPC.Codec.Erlpack in your server's codecs option. This will prevent the vulnerability from being exploited until you can update to the patched version.
Conclusion
The gRPC Erlang package has a critical vulnerability that can lead to remote code execution and denial of service. It is essential to update to version 1.0.0 or later to protect your application. Additionally, using Vulert can help monitor and alert you to open-source vulnerabilities in real-time.
See every vulnerability recorded for grpc →
FAQ
The CVSS score for this vulnerability is 9.2, indicating a critical level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service by exhausting the atom table or remote code execution if an attacker can invoke a decoded fun term.
Yes, if your server explicitly registers GRPC.Codec.Erlpack, it becomes vulnerable to this issue.
If you cannot update immediately, refrain from using the Erlpack codec in your gRPC server configuration as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
