Executive Summary
The gRPC Erlang package has a critical vulnerability (CVE-2026-48853) that allows for remote code execution with a CVSS score of 9.2. This vulnerability affects versions `grpc` ≥ 0.4.0 and < 1.0.0. Immediate action is required to mitigate this vulnerability.
Technical Analysis
The vulnerability is caused by the `GRPC.Codec.Erlpack.decode/2` function calling `:erlang.binary_to_term/1` directly on the raw gRPC message body without the `:safe` option. This allows for two independent exploitation paths:
1. **DoS via atom exhaustion**: A crafted payload encoding large numbers of fresh atoms can saturate the atom table and crash the entire VM.
2. **RCE via fun materialization**: Without `:safe`, `binary_to_term/1` reconstructs fun and external-fun terms from wire data. If the decoded value reaches any call site that applies it, attacker-controlled code executes inside the server process.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by sending a gRPC-framed POST to any RPC path with `Content-Type: application/grpc+erlpack` and a body of `:erlang.term_to_binary(fn -> end)`. The server's `decode/2` materializes the fun; any downstream call site that invokes the decoded value executes the attacker's code. For DoS only, an attacker can send payloads encoding fresh atoms in a loop until the atom table is exhausted and the VM crashes.
Impact Assessment
Any server that explicitly registers `GRPC.Codec.Erlpack` is vulnerable to unauthenticated node-level DoS and potentially RCE. The vulnerability affects `grpc` ≥ 0.4.0 and < 1.0.0. The CVSS score for this vulnerability is 9.2.
Recommended Actions
To mitigate this vulnerability, update the `grpc` package to version 1.0.0 or later. Additionally, ensure that `GRPC.Codec.Erlpack` is not registered by default and is only added to the server's `codecs` option if necessary. Implement a Web Application Firewall (WAF) rule to block suspicious gRPC payloads.
Sources
- GitHub Security Advisories
- CVE-2026-48853