CVE-2026-48854

Name of the Vulnerable Software and Affected Versions grpc versions 0.3.1 through 0.9.x

Description Unauthenticated attackers can exhaust the BEAM memory and crash the server by streaming a large or slow-trickle unary request body. The function read full body/3 in 'Elixir.GRPC.Server.Adapters.Cowboy.Handler' accumulates every received chunk into a single growing binary without a size cap. Furthermore, if the client omits the grpc-timeout header, the per-chunk read timeout is set to infinity, enabling a slow-trickle client to maintain the connection indefinitely while memory consumption increases. A single connection is enough to exhaust server memory and crash the node.

Recommendations Update to version 1.0.0 or later.