# CVE-2026-48854: elixir-grpc memory exhaustion in Cowboy Handler

Source: https://junglewise.ai/threats/cve-2026-48854-elixir-grpc-memory-exhaustion-in-cowboy-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48854 · Severity: high · CVSS 8.7 · Published 2026-06-15

gRPC Erlang is a remote procedure call framework used by Elixir applications to expose microservices. A vulnerability in its HTTP/2 request handler allows unauthenticated attackers to crash the server by sending large or slow-drip request bodies that accumulate unbounded in memory. An attacker can send a single malicious HTTP/2 request to any gRPC endpoint, causing the server process to consume memory until it runs out and terminates, disrupting service availability.

## Quick answers

**Is CVE-2026-48854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48854 being exploited in the wild.

**How severe is CVE-2026-48854?** High severity, with a CVSS score of 8.7, published 15 June 2026.

**Which products and versions are affected?** elixir-grpc grpc >= 0.3.1, < 1.0.0.

**Is there a fix for CVE-2026-48854?** A patch was published on 2026-08-25: Fixed in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48854 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48854?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unbounded resource allocation issue (CWE-770) in the Cowboy HTTP/2 adapter's read_full_body/3 function. The function recursively calls cowboy_req:read_body/2 and concatenates chunks into a growing binary using the `<>` operator with no cumulative size check or configurable maximum. When the optional grpc-timeout header is omitted, timeout_left_opt(nil) returns :infinity, removing per-chunk read deadlines. HTTP/2 WINDOW_UPDATE frames issued by Cowboy allow clients to continue pushing data indefinitely. An attacker can exploit this via a POST request to any unary RPC path with Content-Type: application/grpc+proto, omitting the grpc-timeout header, and streaming a large body without sending END_STREAM. The vulnerability affects gRPC versions ≥ 0.3.1 and is fixed in version 1.0.0.

## Affected products

- elixir-grpc grpc >= 0.3.1, < 1.0.0

## Identifiers

- CVE-2026-48854
- GHSA-q8gf-9rvj-gmgj

## Timeline

- 2026-06-15: disclosed: Vulnerability publicly disclosed in NVD
- 2026-08-25: advisory: GitHub Advisory Database (GHSA-q8gf-9rvj-gmgj) published
- 2026-08-25: patched: Fixed in version 1.0.0

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)