Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-48854
PUBLISHED
More InfoOfficial Page
Assigner-EEF
Assigner Org ID-6b3ad84c-e1a6-4bf7-a703-f496b71e49db
View Known Exploited Vulnerability (KEV) details
Published At-15 Jun, 2026 | 21:55
Updated At-17 Jun, 2026 | 04:46
Rejected At-
▼CVE Numbering Authority (CNA)
Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node. This issue affects grpc from 0.3.1 before 1.0.0.

Affected Products
Vendor
elixir-grpc
Product
grpc
Collection URL
https://repo.hex.pm
Package Name
grpc
Repo
https://github.com/elixir-grpc/grpc
CPEs
  • cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*
Modules
  • 'Elixir.GRPC.Server.Adapters.Cowboy.Handler'
Program Files
  • lib/grpc/server/adapters/cowboy/handler.ex
Program Routines
  • 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3
Default Status
unaffected
Versions
Affected
  • From 0.3.1 before 1.0.0 (semver)
Vendor
elixir-grpc
Product
grpc
Collection URL
https://github.com
Package Name
elixir-grpc/grpc
Repo
https://github.com/elixir-grpc/grpc
CPEs
  • cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*
Modules
  • 'Elixir.GRPC.Server.Adapters.Cowboy.Handler'
Program Files
  • lib/grpc/server/adapters/cowboy/handler.ex
Program Routines
  • 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3
Default Status
unaffected
Versions
Affected
  • From d1abe70a6cad6dac4a3f8235d883d7c896989560 before 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 (git)
Problem Types
TypeCWE IDDescription
CWECWE-770CWE-770 Allocation of Resources Without Limits or Throttling
Type: CWE
CWE ID: CWE-770
Description: CWE-770 Allocation of Resources Without Limits or Throttling
Metrics
VersionBase scoreBase severityVector
4.08.7HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Version: 4.0
Base score: 8.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-130CAPEC-130 Excessive Allocation
CAPEC-231CAPEC-231 Oversized Serialized Data Payloads
CAPEC ID: CAPEC-130
Description: CAPEC-130 Excessive Allocation
CAPEC ID: CAPEC-231
Description: CAPEC-231 Oversized Serialized Data Payloads
Solutions

Configurations

Workarounds

Exploits

Credits

finder
Peter Ullrich
remediation developer
Paulo Valente
analyst
Jonatan Männchen
Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj
vendor-advisory
related
https://cna.erlef.org/cves/CVE-2026-48854.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-48854
related
https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00
patch
Hyperlink: https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj
Resource:
vendor-advisory
related
Hyperlink: https://cna.erlef.org/cves/CVE-2026-48854.html
Resource:
related
Hyperlink: https://osv.dev/vulnerability/EEF-CVE-2026-48854
Resource:
related
Hyperlink: https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00
Resource:
patch
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj
exploit
Hyperlink: https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj
Resource:
exploit
Details not found