What is CVE-2026-48853?

CVE-2026-48853 is a critical-severity insecure deserialization vulnerability in grpc (erlang), affecting versions >= 0.4.0, < 1.0.0. It is fixed in 1.0.0. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.

Which versions of grpc are affected by CVE-2026-48853?

grpc (erlang) versions >= 0.4.0, < 1.0.0 is affected.

Is there a fix for CVE-2026-48853?

Yes. CVE-2026-48853 is fixed in 1.0.0. Upgrade to this version or later.

Is CVE-2026-48853 exploitable, and should I be worried?

Whether CVE-2026-48853 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-48853 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2026-48853 in grpc

Q: Which versions of grpc are affected by CVE-2026-48853?

grpc (erlang) versions >= 0.4.0, < 1.0.0 is affected.

Q: Is there a fix for CVE-2026-48853?

Yes. CVE-2026-48853 is fixed in 1.0.0. Upgrade to this version or later.

Q: Is CVE-2026-48853 exploitable, and should I be worried?

Whether CVE-2026-48853 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-48853 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-48853?

Upgrade grpc to 1.0.0 or later.

Summary

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

GRPC.Codec.Erlpack.decode/2 calls :erlang.binary_to_term/1 directly on the raw gRPC message body without the :safe option. Any unauthenticated peer that can reach a gRPC endpoint with Content-Type: application/grpc+erlpack can crash the entire BEAM node via atom table exhaustion or, if a decoded fun term flows into a call site that invokes it, achieve remote code execution inside the server process.

Details

Root cause, lib/grpc/codec/erlpack.ex implements decode/2 as a bare :erlang.binary_to_term(binary) call with no :safe flag, no size limit, and no type validation. This has two independent exploitation paths:

1. DoS via atom exhaustion, BEAM atoms are never garbage-collected and the global atom table is bounded (~1,048,576 entries). A crafted payload encoding large numbers of fresh atoms saturates the table and crashes the entire VM, taking down all applications on the node.

2. RCE via fun materialization, Without :safe, binary_to_term/1 reconstructs fun and external-fun terms from wire data. If the decoded value reaches any call site that applies it (e.g. Enum.map, Task.async, direct invocation), attacker-controlled code executes inside the server process.

Configuration requirement: GRPC.Codec.Erlpack is not registered by default and must be explicitly added to the server's codecs option.

PoC

Start a gRPC server with codecs: [GRPC.Codec.Erlpack].
Open an HTTP/2 connection to the server.
Send a gRPC-framed POST to any RPC path with Content-Type: application/grpc+erlpack and a body of :erlang.term_to_binary(fn -> <malicious_code> end).
The server's decode/2 materializes the fun; any downstream call site that invokes the decoded value executes the attacker's code.
For DoS only: send payloads encoding fresh atoms in a loop until the atom table is exhausted and the VM crashes.

References

Introduction commit: https://github.com/elixir-grpc/grpc/commit/25bcc569fe2cc4478531a6c546c923205fc751c9
Patch commit: https://github.com/elixir-grpc/grpc/commit/272a97a5ea1b46af1819f14a831fcf35fc91f992

Impact

Affects grpc ≥ 0.4.0. Any server that explicitly registers GRPC.Codec.Erlpack is vulnerable to unauthenticated node-level DoS and potentially RCE.

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

Affected versions

grpc (>= 0.4.0, < 1.0.0)

Security releases

grpc → 1.0.0 (erlang)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade grpc to 1.0.0 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2026-48853? CVE-2026-48853 is a critical-severity insecure deserialization vulnerability in grpc (erlang), affecting versions >= 0.4.0, < 1.0.0. It is fixed in 1.0.0. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
Which versions of grpc are affected by CVE-2026-48853? grpc (erlang) versions >= 0.4.0, < 1.0.0 is affected.
Is there a fix for CVE-2026-48853? Yes. CVE-2026-48853 is fixed in 1.0.0. Upgrade to this version or later.
Is CVE-2026-48853 exploitable, and should I be worried? Whether CVE-2026-48853 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-48853 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-48853? Upgrade grpc to 1.0.0 or later.