{"vulnerability": "CVE-2026-4885", "sightings": [{"uuid": "36d8bd8c-4783-4c99-a4b0-5d036a79faf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mmakf6zijh2a", "content": "CVE-2026-4885 piotnet-addons-for-elementor-pro (CVSS Score 9.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-19T23:32:06.917269Z"}, {"uuid": "bbd1e54e-8ce9-4e1e-8f2d-15c39eb17849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "https://t.me/GithubRedTeam/85211", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-4885\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a xShadow-Here\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 11:19:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPiotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T12:00:07.000000Z"}, {"uuid": "69f29bd5-796e-4833-a12c-b75bac54ad5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "Telegram/0JZVqbB1rKqBB9hp8lsgoqSMQmBZfJa9U3GcChkguYZyduk", "content": "", "creation_timestamp": "2026-05-23T19:00:10.000000Z"}, {"uuid": "6a8b968e-65c2-41ae-9cf4-8f59c9f7669c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "https://t.me/GithubRedTeam/85591", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-4885\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Jenderal92\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-23 17:52:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPiotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-23T18:00:04.000000Z"}, {"uuid": "0afa3915-9add-4281-af3f-7bac2b1671af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "Telegram/w5uXU2fuLydowGU1SOSgKNWyV15qQF5OtJmcXbqSodLpsbQ", "content": "", "creation_timestamp": "2026-05-21T15:00:17.000000Z"}, {"uuid": "40b9b6e0-f489-4266-b207-af4707b4ec3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "Telegram/6gh1HJgE3RFVn7K8UtbcJPp_JwEYzEQXCykvkUTLZjGZEDc", "content": "", "creation_timestamp": "2026-05-21T21:00:05.000000Z"}, {"uuid": "1e26f807-8e6b-41a6-911e-40335d6e6bf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "published-proof-of-concept", "source": "Telegram/ZaHXjBqHV5p0kjhml26f_2eMLQEVC_NJ4MXuG-5T_OiTVdE", "content": "", "creation_timestamp": "2026-05-23T21:00:04.000000Z"}, {"uuid": "59650e00-eecc-4980-a1f4-08c3d702ff7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mn5g2skrze2d", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-4885 Piotnet Addons for Elementor\u00a0Pro\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\n\u3053\u306e\u8106\u5f31\u6027\u306f\u3001WordPress\u7528\u306ePiotnet Addons for Elementor Pro\u30d7\u30e9\u30b0\u30a4\u30f3\u306b\u5b58\u5728\u3057\u3001\u3059\u3079\u3066\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\uff087.1.70\u3092\u542b\u3080\uff09\u3067\u30d5\u30a1\u30a4\u30eb\u30bf\u30a4\u30d7\u306e\u691c\u8a3c\u304c\u6b20\u5982\u3057\u3066\u3044\u308b\u305f\u3081\u3001", "creation_timestamp": "2026-05-31T11:01:56.114414Z"}, {"uuid": "908ab7b0-bf69-491f-8b32-568c5d59100f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48853", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3moeikz22zn2e", "content": "CRITICAL: elixir-grpc grpc (<1.0.0) flaw lets attackers crash BEAM VM or gain RCE via unsafe deserialization. Block risky Content-Type inputs & await vendor patch. https://radar.offseq.com/threat/cve-2026-48853-cwe-502-deserialization-of-untruste-dc5cfe73 #OffSeq #elixir #CVE202648853", "creation_timestamp": "2026-06-16T00:00:37.182218Z"}, {"uuid": "127e24ef-a0e1-4d1a-b935-d5dc3a1021fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48853", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116756842721787890", "content": "\ud83d\udea8 CRITICAL: elixir-grpc grpc (0.4.0-<1.0.0) vulnerable to unauthenticated RCE & DoS via unsafe :erlang.binary_to_term/1 use. Patch status pending \u2014 restrict 'application/grpc+erlpack' inputs now! CVE-2026-48853 https://radar.offseq.com/threat/cve-2026-48853-cwe-502-deserialization-of-untruste-dc5cfe73 #OffSeq #elixir #CVE202648853 #infosec", "creation_timestamp": "2026-06-16T00:00:42.686433Z"}, {"uuid": "ded17b34-a746-4f4b-b106-1cf230bf9b2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moejtklbs22p", "content": "CVE-2026-48853 - Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc\nCVE ID : CVE-2026-48853\n \n Published : June 15, 2026, 11:16 p.m. | 25\u00a0minutes ago\n \n Description : Deserialization of Untrusted Data and Allocation of Resour...", "creation_timestamp": "2026-06-16T00:23:17.509801Z"}, {"uuid": "6e85339b-96bd-449e-ad32-0a3f16bc41b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48854", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moelaczwpr2p", "content": "CVE-2026-48854 - Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc\nCVE ID : CVE-2026-48854\n \n Published : June 15, 2026, 11:16 p.m. | 25\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in elixir-grp...", "creation_timestamp": "2026-06-16T00:48:19.419191Z"}, {"uuid": "d276d20d-ef41-4d1b-8cbe-1fa4d6286ac1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4885", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motosv5ecy2v", "content": "\ud83d\udea8  ALERT: CVE-2026-4885\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nThe Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplet", "creation_timestamp": "2026-06-22T01:02:19.723903Z"}, {"uuid": "85e15560-1aff-4d16-ae8d-c5b7e927e6a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://t.me/bdufstecru/3248", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0435\u043a\u0430 Erlpack \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 gRPC \u0434\u043b\u044f \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Elixir grpc \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-08314\nCVE-2026-48853\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "creation_timestamp": "2026-07-14T01:00:06.307613Z"}, {"uuid": "1aef5f34-c7e3-4018-8e81-9812c0200f77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3248", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0435\u043a\u0430 Erlpack \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 gRPC \u0434\u043b\u044f \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Elixir grpc \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-08314\nCVE-2026-48853\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "creation_timestamp": "2026-07-15T00:00:34.140141Z"}, {"uuid": "0988c7ea-6d42-40c0-b219-ceed9d73a40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwgngkcbk25", "content": "CVE-2026-48853 - grpc\nElixir gRPC versions 0.4.0 to 1.0.0 are vulnerable to unauthenticated code execution and denial of service attacks. An attacker can crash the server by exhausting its atom table or execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grpc #Hex #CVE #infosec", "creation_timestamp": "2026-08-25T18:20:04.314290Z"}, {"uuid": "3f191c65-11a3-4b5d-bee5-cd9b2745f902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48854", "type": "published-proof-of-concept", "source": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj", "content": "", "creation_timestamp": "2026-08-25T20:35:25.533815Z"}, {"uuid": "2a92c422-8625-4028-b91a-9cca43164dbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48853", "type": "published-proof-of-concept", "source": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "content": "", "creation_timestamp": "2026-08-25T20:35:30.552873Z"}, {"uuid": "5516fbd2-938a-4273-b071-24e66df63d40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48854", "type": "seen", "source": "https://gist.github.com/alon710/6e7bd6a50a933b1a1d184dc7dadb1e0f", "content": "# CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48854\n\n## Summary\nAn allocation of resources without limits or throttling vulnerability exists in the Elixir grpc server component when processing unary requests. Unauthenticated remote attackers can stream unbounded data payloads, bypassing standard timeout mechanisms and exhausting host BEAM VM memory, resulting in an immediate crash of the server node.\n\n## TL;DR\nUnauthenticated remote attackers can crash the Elixir gRPC server (BEAM VM) by sending unbounded unary requests or using a slow-trickle stream, bypassing default timeouts and causing out-of-memory crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS Score**: 8.7 (High)\n- **EPSS Score**: 0.00344 (Percentile: 26.92%)\n- **Impact**: Denial of Service (BEAM VM Crash)\n- **Exploit Status**: PoC Level\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc server-side component\n- **grpc**: >= 0.3.1, < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade to elixir-grpc client and server packages version 1.0.0 or higher.\n- Restrict the maximum body size at the reverse proxy or ingress controller layer to prevent large payloads from reaching the backend Cowboy server.\n- Deploy WAF rules to detect and rate-limit HTTP/2 connections with missing grpc-timeout headers that exhibit slow transfer rates.\n\n**Remediation Steps:**\n1. Open your application mix.exs file.\n2. Remove legacy dependencies of the grpc library below version 1.0.0.\n3. Add {:grpc_server, \"~> 1.0.0\"} for server-side applications and {:grpc, \"~> 1.0.0\"} for client-side integrations.\n4. Run mix deps.get to update the ecosystem lock files.\n5. Configure the :max_body_size option under your GRPC.Server.Supervisor startup parameters if your endpoints process payloads larger than 4 MB.\n\n## References\n\n- [GHSA-q8gf-9rvj-gmgj Advisory](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj)\n- [CVE-2026-48854 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48854)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-48854)\n- [Release Tag v1.0.0](https://github.com/elixir-grpc/grpc/releases/tag/v1.0.0)\n- [OSV Advisory Metadata](https://osv.dev/vulnerability/EEF-CVE-2026-48854)\n- [EEF Erlef CNA Reference](https://cna.erlef.org/cves/CVE-2026-48854.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48854) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T09:31:56.119673Z"}, {"uuid": "9b03d3fe-4de1-442e-8123-7ec66194be4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://gist.github.com/alon710/50a574f48857c34c0cb9ded8ce78e9b5", "content": "# CVE-2026-48853: CVE-2026-48853: Remote Code Execution and Denial of Service in elixir-grpc via Erlpack Deserialization\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48853\n\n## Summary\nA critical vulnerability exists in the elixir-grpc library's Erlpack codec, where the unsafe deserialization of Erlang External Term Format (ETF) payloads allows unauthenticated remote attackers to cause a Denial of Service through atom table exhaustion or execute arbitrary code on the host server.\n\n## TL;DR\nUnauthenticated remote attackers can crash the BEAM VM or execute arbitrary code via crafted gRPC payloads containing unsafe Erlang External Term Format (ETF) structures when using the Erlpack codec.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-502, CWE-770\n- **Attack Vector**: Network (AV:N/AC:L/AT:P/PR:N/UI:N)\n- **CVSS Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00573 (44.79th percentile)\n- **Impact**: Remote Code Execution (RCE) / Denial of Service (DoS)\n- **Exploit Status**: PoC / Analysis\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc\n- **grpc**: >= 0.4.0, < 1.0.0 (Fixed in: `v1.0.0`)\n\n## Mitigation\n\n- Upgrade elixir-grpc to version 1.0.0 or higher.\n- Restrict supported server codecs by removing GRPC.Codec.Erlpack from the server configuration.\n- Deploy network firewall or proxy rules to filter and drop HTTP/2 requests with the Content-Type header containing application/grpc+erlpack.\n\n**Remediation Steps:**\n1. Open the mix.exs file in your Elixir project.\n2. Locate the :grpc dependency in your deps/0 block.\n3. Update the version constraint to '~> 1.0.0' or lock it directly to '1.0.0'.\n4. Run 'mix deps.get' to fetch the secure version of the package.\n5. Rebuild and redeploy your microservices to production.\n\n## References\n\n- [Fix Commit in GitHub Repository](https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992)\n- [GitHub Security Advisory (GHSA-grp7-v8xh-rj7h)](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h)\n- [Official Erlef CNA Record](https://cna.erlef.org/cves/CVE-2026-48853.html)\n- [Open Source Vulnerabilities (OSV) Record](https://osv.dev/vulnerability/EEF-CVE-2026-48853)\n- [NVD CVE-2026-48853 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48853)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48853) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T11:32:18.733166Z"}]}