Hex/grpc CVE-2026-48854: high 8.7, EPSS 0.45%
Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc
Action: Upgrade grpc to 1.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.3.0-alpha.2 | 1.0.0 | - |
Fixed versions
| 1.0.0 |
Sources
- osv: EEF-CVE-2026-48854
- nvd: CVE-2026-48854
- https://github.com/elixir-grpc/grpc/security/advisories/GHSA-q8gf-9rvj-gmgj
- https://cna.erlef.org/cves/CVE-2026-48854.html
- https://github.com/elixir-grpc/grpc/commit/d1abe70a6cad6dac4a3f8235d883d7c896989560
- https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00
- https://hex.pm/packages/grpc
CVE-2026-48854 · published · modified · JSON