CVE-2026-48854: Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

Synopsis

An unbounded resource allocation flaw in elixir-grpc/grpc (versions 0.3.1 through 0.9.x) allows an unauthenticated remote attacker to exhaust all available BEAM virtual machine memory and crash the server. The vulnerable read_full_body/3 function accumulates incoming request chunks into a single growing binary with no size cap, and when the client omits the grpc-timeout header the chunk-read timeout becomes infinite, letting a slow-trickle connection hold the server open indefinitely. Successful exploitation of a single connection crashes the gRPC node, causing a full service outage. A patched-image rebuild at version 1.0.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the gRPC service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  The vulnerability is exploitable without any credentials; an unauthenticated client connection is sufficient to begin accumulating memory.

• Victim interactionNot required

  No user action or administrator interaction is required; the attacker initiates the exploit entirely by opening a single gRPC connection.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to stream a large or slow-trickle request body, with no race conditions or environmental factors to navigate.

Blast Radius

• Crashes the BEAM virtual machine node, taking down the entire gRPC server process and all requests in flight.
• Makes the service completely unavailable until the node is restarted, with recovery dependent on external process supervision or orchestration restarts.
• A single malicious connection is sufficient to trigger the crash, meaning even low-volume attackers can cause repeated outages with minimal effort.