CVE-2026-48854
Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node. This issue affects grpc: from 0.3.0-alpha.2 before 1.0.0.
How to fix
- elixir-grpc grpc1.0.0, 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elixir-grpc grpc | 0.3.0-alpha.2 ≤ v < 1.0.0, d1abe70a6cad6dac4a3f8235d883d7c896989560 ≤ v < 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 | 1.0.0, 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.