DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server

#security #cve #cybersecurity

CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server

Vulnerability ID: CVE-2026-48854
CVSS Score: 8.7
Published: 2026-08-25

An allocation of resources without limits or throttling vulnerability exists in the Elixir grpc server component when processing unary requests. Unauthenticated remote attackers can stream unbounded data payloads, bypassing standard timeout mechanisms and exhausting host BEAM VM memory, resulting in an immediate crash of the server node.

TL;DR

Unauthenticated remote attackers can crash the Elixir gRPC server (BEAM VM) by sending unbounded unary requests or using a slow-trickle stream, bypassing default timeouts and causing out-of-memory crashes.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS Score: 8.7 (High)
  • EPSS Score: 0.00344 (Percentile: 26.92%)
  • Impact: Denial of Service (BEAM VM Crash)
  • Exploit Status: PoC Level
  • KEV Status: Not Listed

Affected Systems

  • elixir-grpc/grpc server-side component
  • grpc: >= 0.3.1, < 1.0.0 (Fixed in: 1.0.0)

Code Analysis

Commit: 49e18c3

Fix memory leak and infinite timeout in Cowboy adapter by implementing max_body_size limit and resolving chunk timeouts correctly.

@@ -30,10 +30,22 @@\n+  @default_max_body_size 4 * 1024 * 1024\n...\n-      {:ok, data, req} -> {:ok, body <> data, req}\n-      {:more, data, req} -> read_full_body(req, body <> data, timer)\n+      {:ok, data, req} ->\n+        total = body <> data\n+        if byte_size(total) > max_bytes do\n+          throw({:body_too_large, byte_size(total)})\n+        else\n+          {:ok, total, req}\n+        end
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade to elixir-grpc client and server packages version 1.0.0 or higher.
  • Restrict the maximum body size at the reverse proxy or ingress controller layer to prevent large payloads from reaching the backend Cowboy server.
  • Deploy WAF rules to detect and rate-limit HTTP/2 connections with missing grpc-timeout headers that exhibit slow transfer rates.

Remediation Steps:

  1. Open your application mix.exs file.
  2. Remove legacy dependencies of the grpc library below version 1.0.0.
  3. Add {:grpc_server, "~> 1.0.0"} for server-side applications and {:grpc, "~> 1.0.0"} for client-side integrations.
  4. Run mix deps.get to update the ecosystem lock files.
  5. Configure the :max_body_size option under your GRPC.Server.Supervisor startup parameters if your endpoints process payloads larger than 4 MB.

References

Read the full report for CVE-2026-48854 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)