CVE-2026-48854
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The elixir-grpc library in versions from 0.3.0-alpha.2 before 1.0.0 allows unauthenticated attackers to exhaust BEAM memory and crash the server by streaming a large or slow-trickle unary request body. The read_full_body/3 function accumulates all chunks into a single growing binary with no size cap, and a missing grpc-timeout header sets the read timeout to :infinity. A single connection is enough to exhaust memory and crash the node.
Risk Assessment
An attacker can remotely and without authentication cause denial of service by exhausting server memory. This leads to unavailability of gRPC-based services.
Recommendation
Update elixir-grpc to version 1.0.0 or later. Consider enforcing request body size limits and timeouts at the infrastructure level.
Other vulnerabilities in elixir-grpc
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node. This issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS