Answer in brief
CVE-2026-48854 records a High severity (CVSS 8.7) vulnerability in Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc. The current sources do not mark it as known exploited. The current feed maps grpc (erlang), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps grpc (erlang), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| grpcerlang | >=0.3.1,<1.0.0 | 1.0.0 |
| elixir-grpc/elixir-grpc/grpcgeneric | >=d1abe70a6cad6dac4a3f8235d883d7c896989560 <49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 | 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 |
| elixir-grpc/grpcgeneric | >=0.3.0-alpha.2 <1.0.0 | 1.0.0 |
Published upstream
Jun 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node. This issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.
Quoted source text, attributed separately from HOL analysis.