CVE-2024-8391: Eclipse Vert.x gRPC server does not limit the maximum message size
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).
This is fixed in the 4.5.10 version.
Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.vertx:vertx-grpc-clientto a version that resolves this vulnerability.Fixed in 4.5.10 - Upgrade
Upgrade
maven/io.vertx:vertx-grpc-serverto a version that resolves this vulnerability.Fixed in 4.5.10 - Upgrade
Upgrade
io.vertx:vertx-grpc-serverto a version that resolves this vulnerability.Fixed in 4.5.10 - Upgrade
Upgrade
io.vertx:vertx-grpc-clientto a version that resolves this vulnerability.Fixed in 4.5.10
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8391?
CVE-2024-8391 has a medium severity level due to the potential for denial of service through excessive message payloads.
How do I fix CVE-2024-8391?
To fix CVE-2024-8391, upgrade to version 4.5.10 of io.vertx:vertx-grpc-server or io.vertx:vertx-grpc-client.
What versions are affected by CVE-2024-8391?
CVE-2024-8391 affects Eclipse Vert.x versions from 4.3.0 up to 4.5.9 inclusive.
What is the vulnerability in CVE-2024-8391 related to?
CVE-2024-8391 is related to the gRPC server's lack of limits on the maximum length of message payloads.
Is CVE-2024-8391 related to other vulnerabilities in Eclipse Vert.x?
CVE-2024-8391 is specific to the gRPC server and client components but does not affect other parts of Eclipse Vert.x.