CVE-2026-48853: Deserialization of Untrusted Data

🗓️ 15 Jun 2026 00:00:00Reported by Rapid7Type

Unauthenticated RCE and DoS in elixir-grpc 0.4.0-1.0.0 via erlpack deserialization.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the Erlpack codec library in the gRPC procedure call library for the Elixir programming language allows a perpetrator to execute arbitrary code or cause a service failure.	17 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-48853	16 Jun 202600:00	–	circl
CVE	CVE-2026-48853	15 Jun 202621:56	–	cve
Cvelist	CVE-2026-48853 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc	15 Jun 202621:56	–	cvelist
EUVD	EUVD-2026-37015	25 Aug 202618:09	–	euvd
Github Security Blog	gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads	25 Aug 202618:09	–	github
NVD	CVE-2026-48853	15 Jun 202623:16	–	nvd
OSV	CVE-2026-48853 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc	15 Jun 202621:56	–	osv
OSV	EEF-CVE-2026-48853 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc	15 Jun 202621:56	–	osv
OSV	GHSA-GRP7-V8XH-RJ7H gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads	25 Aug 202618:09	–	osv