GHSA-m425-mq94-257g
First published: Wed Oct 25 2023(Updated: )
### Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit. ### Patches This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0. Along with applying the patch, users should also ensure they are using the `grpc.MaxConcurrentStreams` server option to apply a limit to the server's resources used for any single connection. ### Workarounds None. ### References #6703
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/google.golang.org/grpc | >=1.58.0<1.58.3 | 1.58.3 |
| go/google.golang.org/grpc | >=1.57.0<1.57.1 | 1.57.1 |
| go/google.golang.org/grpc | <1.56.3 | 1.56.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the impact of GHSA-m425-mq94-257g?
In affected releases of gRPC-Go, an attacker can send HTTP/2 requests, cancel them, and send subsequent requests, causing the server to launch more concurrent method handlers than the configured maximum stream limit.
Which software packages are affected by GHSA-m425-mq94-257g?
Affected software packages include google.golang.org/grpc versions 1.58.0 to 1.58.3, 1.57.0 to 1.57.1, and up to version 1.56.3.
What is the severity of GHSA-m425-mq94-257g?
The severity of GHSA-m425-mq94-257g is high with a severity value of 7.5.
How can I fix GHSA-m425-mq94-257g?
To fix GHSA-m425-mq94-257g, upgrade the affected gRPC-Go package to version 1.58.3, 1.57.1, or 1.56.3 depending on the installed version.
Where can I find more information about GHSA-m425-mq94-257g?
More information about GHSA-m425-mq94-257g can be found on the GitHub Security Advisory and Pull Request links provided: [GitHub Security Advisory](https://github.com/grpc/grpc-go/security/advisories/GHSA-m425-mq94-257g), [GitHub Pull Request](https://github.com/grpc/grpc-go/pull/6703), [Commit on GitHub](https://github.com/grpc/grpc-go/commit/f2180b4d5403d2210b30b93098eb7da31c05c721).
- collector/github-advisory-latest
- alias/GHSA-m425-mq94-257g
- collector/github-advisory
- agent/severity
- agent/references
- package-manager/go