{"uuid": "9d1adef8-1fd0-4b2b-a1e8-b6f0caed7507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-q8gf-9rvj-gmgj", "type": "seen", "source": "https://gist.github.com/alon710/6e7bd6a50a933b1a1d184dc7dadb1e0f", "content": "# CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48854\n\n## Summary\nAn allocation of resources without limits or throttling vulnerability exists in the Elixir grpc server component when processing unary requests. Unauthenticated remote attackers can stream unbounded data payloads, bypassing standard timeout mechanisms and exhausting host BEAM VM memory, resulting in an immediate crash of the server node.\n\n## TL;DR\nUnauthenticated remote attackers can crash the Elixir gRPC server (BEAM VM) by sending unbounded unary requests or using a slow-trickle stream, bypassing default timeouts and causing out-of-memory crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS Score**: 8.7 (High)\n- **EPSS Score**: 0.00344 (Percentile: 26.92%)\n- **Impact**: Denial of Service (BEAM VM Crash)\n- **Exploit Status**: PoC Level\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc server-side component\n- **grpc**: >= 0.3.1, < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade to elixir-grpc client and server packages version 1.0.0 or higher.\n- Restrict the maximum body size at the reverse proxy or ingress controller layer to prevent large payloads from reaching the backend Cowboy server.\n- Deploy WAF rules to detect and rate-limit HTTP/2 connections with missing grpc-timeout headers that exhibit slow transfer rates.\n\n**Remediation Steps:**\n1. Open your application mix.exs file.\n2. Remove legacy dependencies of the grpc library below version 1.0.0.\n3. Add {:grpc_server, \"~> 1.0.0\"} for server-side applications and {:grpc, \"~> 1.0.0\"} for client-side integrations.\n4. Run mix deps.get to update the ecosystem lock files.\n5. Configure the :max_body_size option under your GRPC.Server.Supervisor startup parameters if your endpoints process payloads larger than 4 MB.\n\n## References\n\n- [GHSA-q8gf-9rvj-gmgj Advisory](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj)\n- [CVE-2026-48854 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48854)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-48854)\n- [Release Tag v1.0.0](https://github.com/elixir-grpc/grpc/releases/tag/v1.0.0)\n- [OSV Advisory Metadata](https://osv.dev/vulnerability/EEF-CVE-2026-48854)\n- [EEF Erlef CNA Reference](https://cna.erlef.org/cves/CVE-2026-48854.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48854) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T09:31:56.167007Z"}