CVE-2026-48853 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
Unauthenticated attackers can cause denial of service or remote code execution via unsafe Erlang term deserialization in the Elixir gRPC library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48853?
CVE-2026-48853 is a critical unsafe deserialization vulnerability in elixir-grpc grpc, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.
'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.
This issue affects grpc: from 0.4.0 before 1.0.0.
Which versions are affected by CVE-2026-48853?
3 open source packages ship an affected version, including grpc.
| Package | Affected | Fixed in |
|---|---|---|
grpc Hex | From 0.4.0 | 1.0.0 |
grpc Hex | From 0.4.0 | 1.0.0 |
grpc Hex | From 0.4.0 | 1.0.0 |
How do I fix CVE-2026-48853?
Upgrade grpc to 1.0.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-48853 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48853 exists.
Sources
Also known as EEF-CVE-2026-48853, GHSA-grp7-v8xh-rj7h, UBUNTU-CVE-2026-48853.