{"uuid": "9b03d3fe-4de1-442e-8123-7ec66194be4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://gist.github.com/alon710/50a574f48857c34c0cb9ded8ce78e9b5", "content": "# CVE-2026-48853: CVE-2026-48853: Remote Code Execution and Denial of Service in elixir-grpc via Erlpack Deserialization\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48853\n\n## Summary\nA critical vulnerability exists in the elixir-grpc library's Erlpack codec, where the unsafe deserialization of Erlang External Term Format (ETF) payloads allows unauthenticated remote attackers to cause a Denial of Service through atom table exhaustion or execute arbitrary code on the host server.\n\n## TL;DR\nUnauthenticated remote attackers can crash the BEAM VM or execute arbitrary code via crafted gRPC payloads containing unsafe Erlang External Term Format (ETF) structures when using the Erlpack codec.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-502, CWE-770\n- **Attack Vector**: Network (AV:N/AC:L/AT:P/PR:N/UI:N)\n- **CVSS Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00573 (44.79th percentile)\n- **Impact**: Remote Code Execution (RCE) / Denial of Service (DoS)\n- **Exploit Status**: PoC / Analysis\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc\n- **grpc**: >= 0.4.0, < 1.0.0 (Fixed in: `v1.0.0`)\n\n## Mitigation\n\n- Upgrade elixir-grpc to version 1.0.0 or higher.\n- Restrict supported server codecs by removing GRPC.Codec.Erlpack from the server configuration.\n- Deploy network firewall or proxy rules to filter and drop HTTP/2 requests with the Content-Type header containing application/grpc+erlpack.\n\n**Remediation Steps:**\n1. Open the mix.exs file in your Elixir project.\n2. Locate the :grpc dependency in your deps/0 block.\n3. Update the version constraint to '~> 1.0.0' or lock it directly to '1.0.0'.\n4. Run 'mix deps.get' to fetch the secure version of the package.\n5. Rebuild and redeploy your microservices to production.\n\n## References\n\n- [Fix Commit in GitHub Repository](https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992)\n- [GitHub Security Advisory (GHSA-grp7-v8xh-rj7h)](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h)\n- [Official Erlef CNA Record](https://cna.erlef.org/cves/CVE-2026-48853.html)\n- [Open Source Vulnerabilities (OSV) Record](https://osv.dev/vulnerability/EEF-CVE-2026-48853)\n- [NVD CVE-2026-48853 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48853)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48853) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T11:32:18.733166Z"}