Deserialization and Resource Exhaustion Vulnerability in elixir-grpc by Elixir

CVE-2026-48853

What is CVE-2026-48853?

The elixir-grpc library is susceptible to deserialization of untrusted data and resource exhaustion vulnerabilities, enabling unauthenticated attackers to potentially crash the BEAM node. Attackers can exploit the lack of size bound and type guard in the decoding process of gRPC messages, which employs the binary_to_term function without safe options. By sending a specially crafted payload, attackers can create new atoms, capable of exhausting the bounded atom table, leading to a crash of the VM. Additionally, if the crafted payload encodes executable code, it may result in remote code execution within the server process. This vulnerability affects elixir-grpc versions from 0.4.0 up to but not including 1.0.0.

References