Is CVE-2026-48853 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48853 being exploited in the wild.

How severe is CVE-2026-48853?

Critical severity, with a CVSS score of 9.2, published 15 June 2026.

Is there a fix for CVE-2026-48853?

A patch was published on 2026-08-25: Fix released in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48853 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48853?

Check whether you run Grpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48853: elixir-grpc RCE and DoS in Erlpack codec

CVE-2026-48853 · Severity: critical · CVSS 9.2 · Published 2026-06-15

The elixir-grpc library contains a critical vulnerability in its Erlpack codec that allows unauthenticated attackers to execute arbitrary code on any server that explicitly enables the Erlpack message format. The vulnerability stems from unsafe deserialization of gRPC messages without validation or restrictions, enabling either complete service crashes through resource exhaustion or direct code execution within the server process.

Technologies: Grpc. Vendors: Grpc.

Quick answers

Is CVE-2026-48853 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48853 being exploited in the wild.
How severe is CVE-2026-48853?: Critical severity, with a CVSS score of 9.2, published 15 June 2026.
Which products and versions are affected?: Grpc >= 0.4.0, < 1.0.0.
Is there a fix for CVE-2026-48853?: A patch was published on 2026-08-25: Fix released in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48853 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48853?: Check whether you run Grpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability resides in `lib/grpc/codec/erlpack.ex`, where the `decode/2` function calls `:erlang.binary_to_term/1` directly on raw gRPC message bodies without the `:safe` option, size limits, or type validation. This unsafe deserialization enables two independent attack paths: (1) denial-of-service via atom table exhaustion—Erlang atoms are never garbage-collected and the global atom table is capped at ~1,048,576 entries; a crafted payload with fresh atoms saturates the table, crashing the entire BEAM node and all co-hosted applications; (2) remote code execution via fun materialization—without `:safe`, `binary_to_term/1` reconstructs arbitrary callable fun and external-fun terms from the wire; if the deserialized value reaches any invocation site (e.g., `Enum.map`, `Task.async`, direct calls), attacker-controlled code executes in the server process. Attack requires network access to a gRPC endpoint configured with `Content-Type: application/grpc+erlpack`. Configuration requires explicit registration of `GRPC.Codec.Erlpack` in the server's codecs option, but is not enabled by default. The vulnerability affects grpc versions ≥0.4.0 and is patched in version 1.0.0.

Affected products

elixir-grpc grpc >= 0.4.0, < 1.0.0

Identifiers

CVE-2026-48853
GHSA-grp7-v8xh-rj7h

Timeline

2026-06-15: disclosed
2026-08-25: advisory
2026-08-25: patched: Fix released in version 1.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.