{
  "id": 3480430,
  "title": "CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server",
  "url": "https://urgent.news/2026/08/26/cve-2026-48854-cve-2026-48854-unauthenticated-denial-of-service-via",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-26T09:31:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/cve-2026-48854-cve-2026-48854-unauthenticated-denial-of-service-via-resource-exhaustion-in-49ke"
  },
  "original_language": "en",
  "account": "CVE-2026-48854 is a serious vulnerability affecting the Elixir grpc server component, identified by the Common Vulnerabilities and Exposures (CVE) system. With a CVSS score of 8.7, it is classified as high risk, highlighting the severity of the issue. Published on August 25, 2026, this vulnerability allows unauthenticated remote attackers to cause a Denial of Service (DoS) by exploiting resource exhaustion in the Elixir grpc server.\n\nThe core issue lies in the server's handling of unary requests, specifically when processing large data payloads. Without proper resource allocation limits or throttling, attackers can stream unbounded data, bypassing standard timeout mechanisms. This leads to the host BEAM VM (Elixir's virtual machine) running out of memory, resulting in an immediate crash of the server node. Attackers can accomplish this by sending unbounded unary requests or using slow-trickle streams, effectively exploiting the lack of default timeouts.\n\nThe vulnerability, tagged with CWE-770, demonstrates a failure in enforcing a resource constraint, allowing attackers to consume all available resources without limit. This makes it particularly dangerous, as it can be exploited remotely without requiring any authentication from the attacker.\n\nThe CVE score of 8.7 places it in the high-risk category, and its EPSS score of 0.00344 indicates a significant likelihood of exploitation in the wild. The affected systems include the elixir-grpc/grpc server-side component, specifically versions 0.3.1 and 1.0.0. However, version 1.0.0 includes a critical fix for this vulnerability, which involves implementing a max_body_size limit and resolving chunk timeouts correctly.\n\nThe fix and mitigation strategies involve upgrading to version 1.0.0 or higher, as no patches have been released for earlier versions. This update includes configuring the max_body_size option to restrict the maximum body size at the reverse proxy or ingress controller layer, thus preventing large payloads from reaching the backend Cowboy server. Additionally, deploying Web Application Firewall (WAF) rules can help detect and rate-limit HTTP/2 connections with missing grpc-timeout headers that exhibit slow transfer rates, further mitigating the risk of exploitation.\n\nTo remediate the vulnerability, developers should update their application's mix.exs file, removing legacy dependencies of the grpc library below version 1.0.0. They should then add the necessary dependencies for server-side applications and client-side integrations, running mix deps.get to update their ecosystem lock files. This ensures that all affected systems are upgraded to the secure version and properly configured to prevent this type of attack.\n\nFor those needing further information, GitHub Security Advisory provides official PoC details and technical validation parameters. The EEF and CNA references offer additional insights and advisories on CVE-2026-48854, ensuring comprehensive understanding and proper handling of this critical vulnerability.",
  "summary": "CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server Vulnerability ID: CVE-2026-48854 CVSS Score: 8.7 Published: 2026-08-25 An allocation of resources without limits or throttling vulnerability exists in the Elixir grpc server component when processing unary requests. Unauthenticated remote attackers can stream unbounded data payloads, bypassing standard…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}