THREAT OPS › Threat News › [GHSA] GHSA-q8gf-9rvj-gmgj (high) — gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`
[GHSA] GHSA-q8gf-9rvj-gmgj (high) — gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`
GHSA-q8gf-9rvj-gmgj Severity: high CVE: CVE-2026-48854
gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`
### Summary
`'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3` accumulates every received chunk into a single growing binary with no size cap. When the client omits the `grpc-timeout` header, the read timeout resolves to `:infinity`, allowing a sl
Indicators of compromise
- d1abe70a6cad6dac4a3f8235d883d7c896989560sha1
- 49e18c3ec6bb9afe2f712caad3dbab5c56a68a00sha1
- CVE-2026-48854cve
Original source: https://github.com/advisories/GHSA-q8gf-9rvj-gmgj