CVE-2026-48853
2 advisories.
Hex/grpc CVE-2026-48853: critical 9.2, EPSS 0.78%
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
Action: Upgrade grpc to 1.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.4.0 | 1.0.0 | - |
Fixed versions
| 1.0.0 |
Sources
- osv: EEF-CVE-2026-48853
- nvd: CVE-2026-48853
- https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h
- https://cna.erlef.org/cves/CVE-2026-48853.html
- https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9
- https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992
- https://hex.pm/packages/grpc
CVE-2026-48853 · published · modified · JSON
Hex/grpc CVE-2026-48853: critical 9.2, EPSS 0.78%
gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads
Action: Upgrade grpc to 1.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.4.0 | 1.0.0 | - |
Fixed versions
| 1.0.0 |
Sources
- osv: GHSA-grp7-v8xh-rj7h
- nvd: CVE-2026-48853
- https://github.com/elixir-grpc/grpc/security/advisories/GHSA-grp7-v8xh-rj7h
- https://github.com/elixir-grpc/grpc/pull/540
- https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992
- https://cna.erlef.org/cves/CVE-2026-48853.html
- https://github.com/elixir-grpc/grpc
- https://github.com/elixir-grpc/grpc/releases/tag/v1.0.0
- https://osv.dev/vulnerability/EEF-CVE-2026-48853
CVE-2026-48853 · published · modified · JSON