Threat Intelligence Database

A vulnerability in elixir-grpc grpc versions 0.4.0 up to but not including 1.0.0 allows unauthenticated remote attackers to cause a denial of service via a gzip decompression bomb. The issue arises because the GRPC.Compressor.Gzip module decompresses gzip-encoded data without limiting decompressed size or checking compression ratio, leading to excessive memory allocation and potential out-of-memory termination of the BEAM node.

CVE-2026-48854 is a high-severity vulnerability in elixir-grpc grpc versions 0.3.1 up to but not including 1.0.0. It allows unauthenticated attackers to exhaust server memory and crash the BEAM node by sending a large or slow-trickle unary request body. The vulnerability arises because the server accumulates incoming request chunks into a single binary without any size limit and lacks a timeout when the grpc-timeout header is omitted, enabling indefinite memory growth.

A critical vulnerability in elixir-grpc grpc versions 0.4.0 up to but not including 1.0.0 allows unauthenticated attackers to cause denial of service by exhausting the BEAM VM atom table or achieve remote code execution. This occurs because the decode function uses :erlang.binary_to_term/1 without safe options or limits on input size or type, enabling crafted payloads to create arbitrary atoms or execute malicious code.

CVE-2026-48599 is an authorization bypass vulnerability in elixir-grpc grpc versions 0.8.0 up to but not including 1.0.0. It allows authenticated attackers to override path-bound fields by supplying conflicting values via query strings or request bodies, causing authorization checks based on these fields to be bypassed. This occurs due to the use of Map.merge/2 with path bindings as the first argument in the request mapping function, which gives attacker-controlled values precedence over router-extracted values.