CVE-2026-48854: elixir-grpc memory exhaustion in Cowboy Handler

CVE-2026-48854 · Severity: high · CVSS 8.7 · Published 2026-06-15

gRPC Erlang is a remote procedure call framework used by Elixir applications to expose microservices. A vulnerability in its HTTP/2 request handler allows unauthenticated attackers to crash the server by sending large or slow-drip request bodies that accumulate unbounded in memory. An attacker can send a single malicious HTTP/2 request to any gRPC endpoint, causing the server process to consume memory until it runs out and terminates, disrupting service availability.

Quick answers

Is CVE-2026-48854 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48854 being exploited in the wild.
How severe is CVE-2026-48854?
High severity, with a CVSS score of 8.7, published 15 June 2026.
Which products and versions are affected?
elixir-grpc grpc >= 0.3.1, < 1.0.0.
Is there a fix for CVE-2026-48854?
A patch was published on 2026-08-25: Fixed in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48854 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48854?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an unbounded resource allocation issue (CWE-770) in the Cowboy HTTP/2 adapter's read_full_body/3 function. The function recursively calls cowboy_req:read_body/2 and concatenates chunks into a growing binary using the `<>` operator with no cumulative size check or configurable maximum. When the optional grpc-timeout header is omitted, timeout_left_opt(nil) returns :infinity, removing per-chunk read deadlines. HTTP/2 WINDOW_UPDATE frames issued by Cowboy allow clients to continue pushing data indefinitely. An attacker can exploit this via a POST request to any unary RPC path with Content-Type: application/grpc+proto, omitting the grpc-timeout header, and streaming a large body without sending END_STREAM. The vulnerability affects gRPC versions ≥ 0.3.1 and is fixed in version 1.0.0.

Affected products

  • elixir-grpc grpc >= 0.3.1, < 1.0.0

Identifiers

  • CVE-2026-48854
  • GHSA-q8gf-9rvj-gmgj

Timeline

  • 2026-06-15: disclosed: Vulnerability publicly disclosed in NVD
  • 2026-08-25: advisory: GitHub Advisory Database (GHSA-q8gf-9rvj-gmgj) published
  • 2026-08-25: patched: Fixed in version 1.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.