Resource Exhaustion Vulnerability in elixir-grpc by Elixir

CVE-2026-48854

What is CVE-2026-48854?

The elixir-grpc product by Elixir contains a vulnerability that allows unauthenticated attackers to exhaust server memory through unregulated resource allocation. Specifically, the accumulation of received data chunks into an unlimited growing binary poses significant risks. If the client does not specify a grpc-timeout header, the server may indefinitely wait for incoming data, potentially leading to a denial of service by crashing the node with memory overload. A vulnerability of this nature can be exploited with just a single connection, impacting server stability and performance.

References