CVE-2026-48853

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48853", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-25T20:44:10.696Z", "datePublished": "2026-06-15T21:56:15.262Z", "dateUpdated": "2026-09-24T21:08:47.457Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Codec.Erlpack'"], "packageName": "grpc", "packageURL": "pkg:hex/grpc", "product": "grpc", "programFiles": ["lib/grpc/codec/erlpack.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1.0.0", "status": "affected", "version": "0.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Codec.Erlpack'"], "packageName": "elixir-grpc/grpc", "packageURL": "pkg:github/elixir-grpc/grpc", "product": "grpc", "programFiles": ["lib/grpc/codec/erlpack.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "272a97a5ea1b46af1819f14a831fcf35fc91f992", "status": "affected", "version": "25bcc569fe2cc4478531a6c546c923205fc751c9", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><code>GRPC.Codec.Erlpack</code> must be explicitly registered as a codec on the gRPC server.</p>"}, {"base64": false, "type": "text/markdown", "value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server."}], "value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.0", "versionStartIncluding": "0.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Paulo Valente"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "datePublic": "2026-06-15T21:56:15.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.</p>\n<p><code>'Elixir.GRPC.Codec.Erlpack':decode/2</code> (<code>lib/grpc/codec/erlpack.ex</code>) calls <code>:erlang.binary_to_term/1</code> on the raw gRPC message body without the <code>:safe</code> option, no size bound, and no type guard. Any unauthenticated peer that sends a request with <code>Content-Type: application/grpc+erlpack</code> can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.</p>\n<p>This issue affects grpc: from 0.4.0 before 1.0.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n`'Elixir.GRPC.Codec.Erlpack':decode/2` (`lib/grpc/codec/erlpack.ex`) calls `:erlang.binary_to_term/1` on the raw gRPC message body without the `:safe` option, no size bound, and no type guard. Any unauthenticated peer that sends a request with `Content-Type: application/grpc+erlpack` can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."}], "value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}, {"capecId": "CAPEC-231", "descriptions": [{"lang": "en", "value": "CAPEC-231 Oversized Serialized Data Payloads"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 9.2, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T21:08:47.457Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h"}, {"name": "EEF CNA record for CVE-2026-48853", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-48853.html"}, {"name": "OSV record EEF-CVE-2026-48853", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48853"}, {"name": "Introducing commit 25bcc56 in elixir-grpc/grpc", "tags": ["related"], "url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"}, {"name": "Fix commit 272a97a in elixir-grpc/grpc", "tags": ["patch"], "url": "https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992"}], "source": {"discovery": "EXTERNAL"}, "title": "Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc"}, "adp": [{"references": [{"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T14:44:19.175606Z", "id": "CVE-2026-48853", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:45:02.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48853", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-16T14:44:19.175606Z"}}}], "references": [{"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:44:54.804Z"}}], "cna": {"title": "Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Paulo Valente"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}, {"capecId": "CAPEC-231", "descriptions": [{"lang": "en", "value": "CAPEC-231 Oversized Serialized Data Payloads"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "modules": ["'Elixir.GRPC.Codec.Erlpack'"], "product": "grpc", "versions": [{"status": "affected", "version": "0.4.0", "lessThan": "1.0.0", "versionType": "semver"}], "packageURL": "pkg:hex/grpc", "packageName": "grpc", "programFiles": ["lib/grpc/codec/erlpack.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"}]}, {"cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "modules": ["'Elixir.GRPC.Codec.Erlpack'"], "product": "grpc", "versions": [{"status": "affected", "version": "25bcc569fe2cc4478531a6c546c923205fc751c9", "lessThan": "272a97a5ea1b46af1819f14a831fcf35fc91f992", "versionType": "git"}], "packageURL": "pkg:github/elixir-grpc/grpc", "packageName": "elixir-grpc/grpc", "programFiles": ["lib/grpc/codec/erlpack.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"}]}], "datePublic": "2026-06-15T21:56:15.000Z", "references": [{"url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-48853.html", "name": "EEF CNA record for CVE-2026-48853", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48853", "name": "OSV record EEF-CVE-2026-48853", "tags": ["related"]}, {"url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9", "name": "Introducing commit 25bcc56 in elixir-grpc/grpc", "tags": ["related"]}, {"url": "https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992", "name": "Fix commit 272a97a in elixir-grpc/grpc", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.</p>\n<p><code>'Elixir.GRPC.Codec.Erlpack':decode/2</code> (<code>lib/grpc/codec/erlpack.ex</code>) calls <code>:erlang.binary_to_term/1</code> on the raw gRPC message body without the <code>:safe</code> option, no size bound, and no type guard. Any unauthenticated peer that sends a request with <code>Content-Type: application/grpc+erlpack</code> can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.</p>\n<p>This issue affects grpc: from 0.4.0 before 1.0.0.</p>", "base64": false}, {"type": "text/markdown", "value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n`'Elixir.GRPC.Codec.Erlpack':decode/2` (`lib/grpc/codec/erlpack.ex`) calls `:erlang.binary_to_term/1` on the raw gRPC message body without the `:safe` option, no size bound, and no type guard. Any unauthenticated peer that sends a request with `Content-Type: application/grpc+erlpack` can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "configurations": [{"lang": "en", "value": "GRPC.Codec.Erlpack must be explicitly registered as a codec on the gRPC server.", "supportingMedia": [{"type": "text/html", "value": "<p><code>GRPC.Codec.Erlpack</code> must be explicitly registered as a codec on the gRPC server.</p>", "base64": false}, {"type": "text/markdown", "value": "`GRPC.Codec.Erlpack` must be explicitly registered as a codec on the gRPC server.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.0", "versionStartIncluding": "0.4.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T21:08:47.457Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48853", "state": "PUBLISHED", "dateUpdated": "2026-09-24T21:08:47.457Z", "dateReserved": "2026-05-25T20:44:10.696Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-15T21:56:15.262Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Codec.Erlpack'"], "packageName": "grpc", "packageURL": "pkg:hex/grpc", "product": "grpc", "programFiles": ["lib/grpc/codec/erlpack.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "1.0.0", "status": "affected", "version": "0.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.GRPC.Codec.Erlpack'"], "packageName": "elixir-grpc/grpc", "packageURL": "pkg:github/elixir-grpc/grpc", "product": "grpc", "programFiles": ["lib/grpc/codec/erlpack.ex"], "programRoutines": [{"name": "'Elixir.GRPC.Codec.Erlpack':decode/2"}], "repo": "https://github.com/elixir-grpc/grpc", "vendor": "elixir-grpc", "versions": [{"lessThan": "272a97a5ea1b46af1819f14a831fcf35fc91f992", "status": "affected", "version": "25bcc569fe2cc4478531a6c546c923205fc751c9", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n\n'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\n\nThis issue affects grpc: from 0.4.0 before 1.0.0."}, {"lang": "es", "value": "Las vulnerabilidades de deserializaci\u00f3n de datos no confiables y asignaci\u00f3n de recursos sin l\u00edmites o estrangulamiento en elixir-grpc grpc permiten a atacantes no autenticados colapsar el nodo BEAM a trav\u00e9s del agotamiento de la tabla de \u00e1tomos y, cuando un t\u00e9rmino decodificado fluye a un sitio de llamada que lo invoca, lograr la ejecuci\u00f3n remota de c\u00f3digo en el servidor.\n\n\u2019Elixir.GRPC.Codec.Erlpack\u2019:decode/2 (lib/grpc/codec/erlpack.ex) llama a :erlang.binary_to_term/1 en el cuerpo del mensaje gRPC sin procesar sin la opci\u00f3n :safe, sin l\u00edmite de tama\u00f1o y sin protecci\u00f3n de tipo. Cualquier par no autenticado que env\u00eda una solicitud con Content-Type: application/grpc+erlpack puede enviar una carga \u00fatil manipulada que crea nuevos \u00e1tomos arbitrarios (que nunca son recolectados por el recolector de basura, agotando la tabla de \u00e1tomos limitada y colapsando la VM) o que codifica un t\u00e9rmino fun que, si se aplica en cualquier lugar posterior, ejecuta c\u00f3digo controlado por el atacante dentro del proceso del servidor.\n\nEste problema afecta a grpc desde 0.4.0 antes de 1.0.0."}], "id": "CVE-2026-48853", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48853", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-16T14:44:19.175606Z", "version": "2.0.3"}}]}, "published": "2026-06-15T23:16:45.663", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-48853.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48853"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "grpc: elixir-grpc grpc: Remote Code Execution and Denial of Service via Deserialization of Untrusted Data", "id": "2489071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489071"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server.\n'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process.\nThis issue affects grpc from 0.4.0 before 1.0.0.", "A flaw was found in the grpc component of elixir-grpc. This vulnerability allows unauthenticated attackers to send specially crafted messages, leading to two critical outcomes. First, it can cause a Denial of Service (DoS) by crashing the Erlang virtual machine (BEAM node). Second, under certain conditions, it enables remote code execution, allowing attackers to run their own programs on the affected server."], "name": "CVE-2026-48853", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "grpc", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-06-15T21:56:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48853\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48853\nhttps://cna.erlef.org/cves/CVE-2026-48853.html\nhttps://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992\nhttps://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h\nhttps://osv.dev/vulnerability/EEF-CVE-2026-48853"], "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,1.0.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[25bcc569fe2cc4478531a6c546c923205fc751c9,272a97a5ea1b46af1819f14a831fcf35fc91f992)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "grpc", "source": "cna", "vendor": "elixir-grpc"}, "product": "grpc", "vendor": "elixir-grpc"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[25bcc569fe2cc4478531a6c546c923205fc751c9,272a97a5ea1b46af1819f14a831fcf35fc91f992)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grpc", "source": "cna", "vendor": "elixir-grpc"}, "product": "grpc", "vendor": "elixir-grpc"}], "created": "2026-06-16T02:30:14.515374+00:00", "updated": "2026-09-26T06:30:03.495078+00:00", "vendors": ["elixir-grpc", "elixir-grpc$PRODUCT$grpc"]}