{"vulnerability": "GHSA-grp7-v8xh-rj7h", "sightings": [{"uuid": "ad4a6a57-1319-4242-b0b4-521d65d87227", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-GRP7-V8XH-RJ7H", "type": "seen", "source": "https://t.me/bdufstecru/3248", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0435\u043a\u0430 Erlpack \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 gRPC \u0434\u043b\u044f \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Elixir grpc \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-08314\nCVE-2026-48853\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "creation_timestamp": "2026-07-14T01:00:06.351365Z"}, {"uuid": "85433d57-9c19-4910-83f7-18df69ddf0e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-GRP7-V8XH-RJ7H", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3248", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0435\u043a\u0430 Erlpack \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 gRPC \u0434\u043b\u044f \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Elixir grpc \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-08314\nCVE-2026-48853\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "creation_timestamp": "2026-07-15T00:00:34.168730Z"}, {"uuid": "f6890093-7b96-4b49-a332-09de931e69fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-grp7-v8xh-rj7h", "type": "seen", "source": "https://gist.github.com/alon710/50a574f48857c34c0cb9ded8ce78e9b5", "content": "# CVE-2026-48853: CVE-2026-48853: Remote Code Execution and Denial of Service in elixir-grpc via Erlpack Deserialization\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48853\n\n## Summary\nA critical vulnerability exists in the elixir-grpc library's Erlpack codec, where the unsafe deserialization of Erlang External Term Format (ETF) payloads allows unauthenticated remote attackers to cause a Denial of Service through atom table exhaustion or execute arbitrary code on the host server.\n\n## TL;DR\nUnauthenticated remote attackers can crash the BEAM VM or execute arbitrary code via crafted gRPC payloads containing unsafe Erlang External Term Format (ETF) structures when using the Erlpack codec.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-502, CWE-770\n- **Attack Vector**: Network (AV:N/AC:L/AT:P/PR:N/UI:N)\n- **CVSS Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00573 (44.79th percentile)\n- **Impact**: Remote Code Execution (RCE) / Denial of Service (DoS)\n- **Exploit Status**: PoC / Analysis\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc\n- **grpc**: >= 0.4.0, < 1.0.0 (Fixed in: `v1.0.0`)\n\n## Mitigation\n\n- Upgrade elixir-grpc to version 1.0.0 or higher.\n- Restrict supported server codecs by removing GRPC.Codec.Erlpack from the server configuration.\n- Deploy network firewall or proxy rules to filter and drop HTTP/2 requests with the Content-Type header containing application/grpc+erlpack.\n\n**Remediation Steps:**\n1. Open the mix.exs file in your Elixir project.\n2. Locate the :grpc dependency in your deps/0 block.\n3. Update the version constraint to '~> 1.0.0' or lock it directly to '1.0.0'.\n4. Run 'mix deps.get' to fetch the secure version of the package.\n5. Rebuild and redeploy your microservices to production.\n\n## References\n\n- [Fix Commit in GitHub Repository](https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992)\n- [GitHub Security Advisory (GHSA-grp7-v8xh-rj7h)](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h)\n- [Official Erlef CNA Record](https://cna.erlef.org/cves/CVE-2026-48853.html)\n- [Open Source Vulnerabilities (OSV) Record](https://osv.dev/vulnerability/EEF-CVE-2026-48853)\n- [NVD CVE-2026-48853 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48853)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48853) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T11:32:18.778378Z"}]}