Answer in brief
CVE-2026-48853 records a Critical severity (CVSS 9.2) vulnerability in Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc. The current sources do not mark it as known exploited. The current feed maps grpc (erlang), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps grpc (erlang), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| grpcerlang | >=0.4.0,<1.0.0 | 1.0.0 |
| elixir-grpc/elixir-grpc/grpcgeneric | >=25bcc569fe2cc4478531a6c546c923205fc751c9 <272a97a5ea1b46af1819f14a831fcf35fc91f992 | 272a97a5ea1b46af1819f14a831fcf35fc91f992 |
| elixir-grpc/grpcgeneric | >=0.4.0 <1.0.0 | 1.0.0 |
Published upstream
Jun 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0.
Quoted source text, attributed separately from HOL analysis.