The elixir-grpc grpc library (versions >=0.4.0 and <1.0.0) contains a deserialization vulnerability in the 'Elixir.GRPC.Codec.Erlpack':decode/2 function. This function calls :erlang.binary_to_term/1 on incoming gRPC messages with Content-Type 'application/grpc+erlpack' without using the :safe option, size limits, or type guards. An unauthenticated attacker can exploit this by sending a malicious payload that creates arbitrary atoms, which are never garbage collected, leading to atom table exhaustion and a crash of the BEAM node. Additionally, if the deserialized term is a function (fun) and is invoked downstream, it can lead to remote code execution within the server process.

Successful exploitation allows unauthenticated attackers to cause a denial of service by crashing the BEAM virtual machine through atom table exhaustion. Furthermore, it can lead to remote code execution on the server if the crafted payload includes a function term that is invoked, potentially compromising the server's integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid accepting gRPC requests with Content-Type 'application/grpc+erlpack' from untrusted sources or implement strict input validation and deserialization safeguards. Monitor vendor channels for updates and apply official patches once released.