CVE-2026-48853: CVE-2026-48853: Remote Code Execution and Denial of Service in elixir-grpc via Erlpack Deserialization

#security #cve #cybersecurity

CVE-2026-48853: Remote Code Execution and Denial of Service in elixir-grpc via Erlpack Deserialization

Vulnerability ID: CVE-2026-48853
CVSS Score: 9.2
Published: 2026-08-25

A critical vulnerability exists in the elixir-grpc library's Erlpack codec, where the unsafe deserialization of Erlang External Term Format (ETF) payloads allows unauthenticated remote attackers to cause a Denial of Service through atom table exhaustion or execute arbitrary code on the host server.

TL;DR

Unauthenticated remote attackers can crash the BEAM VM or execute arbitrary code via crafted gRPC payloads containing unsafe Erlang External Term Format (ETF) structures when using the Erlpack codec.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-502, CWE-770
Attack Vector: Network (AV:N/AC:L/AT:P/PR:N/UI:N)
CVSS Score: 9.2 (Critical)
EPSS Score: 0.00573 (44.79th percentile)
Impact: Remote Code Execution (RCE) / Denial of Service (DoS)
Exploit Status: PoC / Analysis
CISA KEV Status: Not Listed

Affected Systems

elixir-grpc/grpc
grpc: >= 0.4.0, < 1.0.0 (Fixed in: v1.0.0)

Code Analysis

Commit: 272a97a

Harden Erlpack decoder against untrusted payloads (CVE-2026-48853 / GHSA-grp7-v8xh-rj7h)

@@ -10,6 +27,38 @@ defmodule GRPC.Codec.Erlpack do
   def name() do
+...
-    :erlang.binary_to_term(binary)
+    term = :erlang.binary_to_term(binary, [:safe])
+    ensure_safe_term!(term)
+    term
+  end

Exploit Details

GitHub Security Advisory: Analysis of the Erlpack deserialization vectors (atom table exhaustion and function execution).

Mitigation Strategies

Upgrade elixir-grpc to version 1.0.0 or higher.
Restrict supported server codecs by removing GRPC.Codec.Erlpack from the server configuration.
Deploy network firewall or proxy rules to filter and drop HTTP/2 requests with the Content-Type header containing application/grpc+erlpack.

Remediation Steps:

Open the mix.exs file in your Elixir project.
Locate the :grpc dependency in your deps/0 block.
Update the version constraint to '~> 1.0.0' or lock it directly to '1.0.0'.
Run 'mix deps.get' to fetch the secure version of the package.
Rebuild and redeploy your microservices to production.

References

Read the full report for CVE-2026-48853 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community