The vulnerability in elixir-grpc grpc arises from unsafe deserialization in the 'Elixir.GRPC.Codec.Erlpack':decode/2 function, which calls :erlang.binary_to_term/1 on incoming gRPC messages with Content-Type 'application/grpc+erlpack' without the :safe option, size bounds, or type guards. This allows unauthenticated attackers to send crafted payloads that can mint arbitrary atoms, leading to atom table exhaustion and VM crash, or encode function terms that, if invoked downstream, execute attacker-controlled code on the server. The issue affects grpc versions from 0.4.0 up to but not including 1.0.0.

Successful exploitation can cause denial of service by crashing the BEAM node through atom table exhaustion or enable remote code execution on the server process, potentially allowing full compromise of the affected system. The vulnerability requires no privileges and no user interaction, making it highly severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid accepting gRPC requests with Content-Type 'application/grpc+erlpack' from untrusted sources or implement strict input validation and deserialization safeguards. Monitor vendor channels for updates and apply official patches once released.