{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/elixir-grpc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-48853"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["grpc","grpc (\u003e= 0.4.0, \u003c 1.0.0)","grpc (\u003e= 0.3.1, \u003c 1.0.0)","grpc (\u003e= 0.8.0, \u003c 1.0.0)"],"_cs_severities":["critical"],"_cs_tags":["denial-of-service","elixir","erlang","grpc","memory-exhaustion"],"_cs_type":"advisory","_cs_vendors":["elixir-grpc"],"content_html":"\u003cp\u003eThe \u003ccode\u003egrpc\u003c/code\u003e package for Elixir (versions 0.4.0 through 0.9.x) contains a critical vulnerability in \u003ccode\u003eGRPC.Codec.Erlpack.decode/2\u003c/code\u003e that allows for unauthenticated remote code execution (RCE) and denial of service (DoS). The vulnerability stems from the use of \u003ccode\u003e:erlang.binary_to_term/1\u003c/code\u003e on raw gRPC message bodies without the mandatory \u003ccode\u003e:safe\u003c/code\u003e option. This function is used to deserialize data provided via the \u003ccode\u003eapplication/grpc+erlpack\u003c/code\u003e content type.\u003c/p\u003e\n\u003cp\u003eBecause the deserialization process is unsafe, it permits the instantiation of arbitrary terms, including function objects (fun terms) and large numbers of atoms. An attacker can exploit this in two ways: by saturating the BEAM global atom table (which is capped at ~1 million entries) to crash the entire node, or by injecting serialized function terms that execute arbitrary code when subsequently invoked by the host application. This vulnerability is specific to environments where developers have explicitly registered \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e in their gRPC server configuration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target gRPC server that has explicitly configured \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e as a codec.\u003c/li\u003e\n\u003cli\u003eAttacker establishes a standard HTTP/2 connection to the gRPC service endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious gRPC payload serialized via \u003ccode\u003e:erlang.term_to_binary\u003c/code\u003e containing a fun term for RCE or repeated atom definitions for DoS.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST request to the gRPC endpoint with the header \u003ccode\u003eContent-Type: application/grpc+erlpack\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server's \u003ccode\u003eGRPC.Codec.Erlpack.decode/2\u003c/code\u003e function parses the request body and materializes the unsafe terms into the server process memory.\u003c/li\u003e\n\u003cli\u003eFor DoS, the accumulated atoms exhaust the BEAM virtual machine's global atom table, resulting in a node-wide crash.\u003c/li\u003e\n\u003cli\u003eFor RCE, the malicious fun term is passed to a downstream Elixir call site (such as \u003ccode\u003eEnum.map\u003c/code\u003e or \u003ccode\u003eTask.async\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe host application executes the attacker-controlled code within the context of the server process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to fully compromise the host server by executing arbitrary code with the privileges of the BEAM virtual machine process. Alternatively, attackers can force a complete denial of service by crashing the node through atom table exhaustion. This vulnerability affects any gRPC-based Elixir application that enables the Erlpack codec.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate update of the \u003ccode\u003egrpc\u003c/code\u003e Elixir package to version 1.0.0 or later, which addresses this deserialization flaw. For environments that cannot immediately patch, remove \u003ccode\u003eGRPC.Codec.Erlpack\u003c/code\u003e from the list of registered codecs in your gRPC server configuration. Detection engineers should inspect server logs for any incoming requests utilizing the \u003ccode\u003eapplication/grpc+erlpack\u003c/code\u003e content type and verify if such usage is expected in the production environment.\u003c/p\u003e\n","date_modified":"2026-08-25T18:49:27Z","date_published":"2026-08-25T18:48:23Z","id":"https://feed.craftedsignal.io/briefs/2026-08-grpc-erlpack-rce/","summary":"The GRPC.Codec.Erlpack decoder in the Elixir gRPC package is vulnerable to unauthenticated remote code execution and node-level denial of service due to insecure deserialization of untrusted gRPC payloads.","title":"Critical RCE and DoS Vulnerability in Elixir gRPC Package","url":"https://feed.craftedsignal.io/briefs/2026-08-grpc-erlpack-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Elixir-Grpc","version":"https://jsonfeed.org/version/1.1"}