CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server

Vulnerability ID: CVE-2026-48854
CVSS Score: 8.7
Published: 2026-08-25

An allocation of resources without limits or throttling vulnerability exists in the Elixir grpc server component when processing unary requests. Unauthenticated remote attackers can stream unbounded data payloads, bypassing standard timeout mechanisms and exhausting host BEAM VM memory, resulting in an immediate crash of the server node.

TL;DR

Unauthenticated remote attackers can crash the Elixir gRPC server (BEAM VM) by sending unbounded unary requests or using a slow-trickle stream, bypassing default timeouts and causing out-of-memory crashes.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-770
Attack Vector: Network
CVSS Score: 8.7 (High)
EPSS Score: 0.00344 (Percentile: 26.92%)
Impact: Denial of Service (BEAM VM Crash)
Exploit Status: PoC Level
KEV Status: Not Listed

Affected Systems

elixir-grpc/grpc server-side component
grpc: >= 0.3.1, < 1.0.0 (Fixed in: 1.0.0)

Code Analysis

Commit: 49e18c3

Fix memory leak and infinite timeout in Cowboy adapter by implementing max_body_size limit and resolving chunk timeouts correctly.

@@ -30,10 +30,22 @@\n+  @default_max_body_size 4 * 1024 * 1024\n...\n-      {:ok, data, req} -> {:ok, body <> data, req}\n-      {:more, data, req} -> read_full_body(req, body <> data, timer)\n+      {:ok, data, req} ->\n+        total = body <> data\n+        if byte_size(total) > max_bytes do\n+          throw({:body_too_large, byte_size(total)})\n+        else\n+          {:ok, total, req}\n+        end

Exploit Details

GitHub Security Advisory: Official PoC details and technical validation parameters.

Mitigation Strategies

Upgrade to elixir-grpc client and server packages version 1.0.0 or higher.
Restrict the maximum body size at the reverse proxy or ingress controller layer to prevent large payloads from reaching the backend Cowboy server.
Deploy WAF rules to detect and rate-limit HTTP/2 connections with missing grpc-timeout headers that exhibit slow transfer rates.

Remediation Steps:

Open your application mix.exs file.
Remove legacy dependencies of the grpc library below version 1.0.0.
Add {:grpc_server, "~> 1.0.0"} for server-side applications and {:grpc, "~> 1.0.0"} for client-side integrations.
Run mix deps.get to update the ecosystem lock files.
Configure the :max_body_size option under your GRPC.Server.Supervisor startup parameters if your endpoints process payloads larger than 4 MB.