{"vulnerability": "cve-2026-48853", "sightings": [{"uuid": "908ab7b0-bf69-491f-8b32-568c5d59100f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48853", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3moeikz22zn2e", "content": "CRITICAL: elixir-grpc grpc (<1.0.0) flaw lets attackers crash BEAM VM or gain RCE via unsafe deserialization. Block risky Content-Type inputs & await vendor patch. https://radar.offseq.com/threat/cve-2026-48853-cwe-502-deserialization-of-untruste-dc5cfe73 #OffSeq #elixir #CVE202648853", "creation_timestamp": "2026-06-16T00:00:37.182218Z"}, {"uuid": "127e24ef-a0e1-4d1a-b935-d5dc3a1021fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48853", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116756842721787890", "content": "\ud83d\udea8 CRITICAL: elixir-grpc grpc (0.4.0-<1.0.0) vulnerable to unauthenticated RCE & DoS via unsafe :erlang.binary_to_term/1 use. Patch status pending \u2014 restrict 'application/grpc+erlpack' inputs now! CVE-2026-48853 https://radar.offseq.com/threat/cve-2026-48853-cwe-502-deserialization-of-untruste-dc5cfe73 #OffSeq #elixir #CVE202648853 #infosec", "creation_timestamp": "2026-06-16T00:00:42.686433Z"}, {"uuid": "ded17b34-a746-4f4b-b106-1cf230bf9b2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moejtklbs22p", "content": "CVE-2026-48853 - Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc\nCVE ID : CVE-2026-48853\n \n Published : June 15, 2026, 11:16 p.m. | 25\u00a0minutes ago\n \n Description : Deserialization of Untrusted Data and Allocation of Resour...", "creation_timestamp": "2026-06-16T00:23:17.509801Z"}, {"uuid": "85e15560-1aff-4d16-ae8d-c5b7e927e6a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://t.me/bdufstecru/3248", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0435\u043a\u0430 Erlpack \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 gRPC \u0434\u043b\u044f \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Elixir grpc \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-08314\nCVE-2026-48853\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "creation_timestamp": "2026-07-14T01:00:06.307613Z"}, {"uuid": "1aef5f34-c7e3-4018-8e81-9812c0200f77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3248", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0435\u043a\u0430 Erlpack \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 gRPC \u0434\u043b\u044f \u044f\u0437\u044b\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Elixir grpc \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-08314\nCVE-2026-48853\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "creation_timestamp": "2026-07-15T00:00:34.140141Z"}, {"uuid": "0988c7ea-6d42-40c0-b219-ceed9d73a40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwgngkcbk25", "content": "CVE-2026-48853 - grpc\nElixir gRPC versions 0.4.0 to 1.0.0 are vulnerable to unauthenticated code execution and denial of service attacks. An attacker can crash the server by exhausting its atom table or execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#grpc #Hex #CVE #infosec", "creation_timestamp": "2026-08-25T18:20:04.314290Z"}, {"uuid": "2a92c422-8625-4028-b91a-9cca43164dbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48853", "type": "published-proof-of-concept", "source": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h", "content": "", "creation_timestamp": "2026-08-25T20:35:30.552873Z"}, {"uuid": "9b03d3fe-4de1-442e-8123-7ec66194be4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48853", "type": "seen", "source": "https://gist.github.com/alon710/50a574f48857c34c0cb9ded8ce78e9b5", "content": "# CVE-2026-48853: CVE-2026-48853: Remote Code Execution and Denial of Service in elixir-grpc via Erlpack Deserialization\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48853\n\n## Summary\nA critical vulnerability exists in the elixir-grpc library's Erlpack codec, where the unsafe deserialization of Erlang External Term Format (ETF) payloads allows unauthenticated remote attackers to cause a Denial of Service through atom table exhaustion or execute arbitrary code on the host server.\n\n## TL;DR\nUnauthenticated remote attackers can crash the BEAM VM or execute arbitrary code via crafted gRPC payloads containing unsafe Erlang External Term Format (ETF) structures when using the Erlpack codec.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-502, CWE-770\n- **Attack Vector**: Network (AV:N/AC:L/AT:P/PR:N/UI:N)\n- **CVSS Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00573 (44.79th percentile)\n- **Impact**: Remote Code Execution (RCE) / Denial of Service (DoS)\n- **Exploit Status**: PoC / Analysis\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc\n- **grpc**: >= 0.4.0, < 1.0.0 (Fixed in: `v1.0.0`)\n\n## Mitigation\n\n- Upgrade elixir-grpc to version 1.0.0 or higher.\n- Restrict supported server codecs by removing GRPC.Codec.Erlpack from the server configuration.\n- Deploy network firewall or proxy rules to filter and drop HTTP/2 requests with the Content-Type header containing application/grpc+erlpack.\n\n**Remediation Steps:**\n1. Open the mix.exs file in your Elixir project.\n2. Locate the :grpc dependency in your deps/0 block.\n3. Update the version constraint to '~> 1.0.0' or lock it directly to '1.0.0'.\n4. Run 'mix deps.get' to fetch the secure version of the package.\n5. Rebuild and redeploy your microservices to production.\n\n## References\n\n- [Fix Commit in GitHub Repository](https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992)\n- [GitHub Security Advisory (GHSA-grp7-v8xh-rj7h)](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h)\n- [Official Erlef CNA Record](https://cna.erlef.org/cves/CVE-2026-48853.html)\n- [Open Source Vulnerabilities (OSV) Record](https://osv.dev/vulnerability/EEF-CVE-2026-48853)\n- [NVD CVE-2026-48853 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48853)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48853) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T11:32:18.733166Z"}]}