CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server

CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server Vulnerability ID: CVE-2026-48854 CVSS Score: 8.7 Published: 2026-08-25 An allocation of resources without limits or throttling vulnerability exists in the Elixir grpc server component when processing unary requests. Unauthenticated remote attackers can stream unbounded data payloads, bypassing standard timeout mechanisms and exhausting host BEAM VM memory, resulting in an immediate crash of the server node. TL;DR Unauthenticated remote attackers can crash the Elixir gRPC server (BEAM VM) by sending unbounded unary requests or using a slow-trickle stream, bypassing default timeouts and causing out-of-memory crashes. ⚠️ Exploit Status: POC Technical Details CWE ID : CWE-770 Attack Vector : Network CVSS Score : 8.7 (High) EPSS Score : 0.00344 (Percentile: 26.92%) Impact : Denial of Service (BEAM VM Crash) Exploit Status : PoC Level KEV Status : Not Listed Affected Systems elixir-grpc/grpc server-side component grpc : >= 0.3.1, < 1.0.0 (Fixed in: 1.0.0 ) Code Analysis Commit: 49e18c3 Fix memory leak and infinite timeout in Cowboy adapter by implementing max_body_size limit and resolving chunk timeouts correctly. @@ -30,10 +30,22 @@ \n+ @default_max_body_size 4 * 1024 * 1024\n...\n- {:ok, data, req} -> {:ok, body <> data, req}\n- {:more, data, req} -> read_full_body(req, body <> data, timer)\n+ {:ok, data, req} ->\n+ total = body <> data\n+ if byte_size(total) > max_bytes do\n+ throw({:body_too_large, byte_size(total)})\n+ else\n+ {:ok, total, req}\n+ end Exploit Details GitHub Security Advisory : Official PoC details and technical validation parameters. Mitigation Strategies Upgrade to elixir-grpc client and server packages version 1.0.0 or higher. Restrict the maximum body size at the reverse proxy or ingress controller layer to prevent large payloads from reaching the backend Cowboy server. Deploy WAF rules to detect and rate-limit HTTP/2 connections with missing grpc-timeo