GHSA-vp52-pcj8-j9qc: Go/google.golang.org/grpc vulnerability
Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.
Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).
Patches The change to fix this issue is merged in master and a patch release, 1.83.1, has been published that contains this fix.
Workarounds This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.
This behavior is enabled by default. A temporary escape hatch is provided via the environment variable GRPCGOEXPERIMENTALENABLERECEIVEBUFFERCOMPACTION=false to disable the feature if unforeseen issues arise, but it will be removed in a future release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/google.golang.org/grpcto a version that resolves this vulnerability.Fixed in 1.83.1 - Upgrade
Upgrade
gRPC Goto a version that resolves this vulnerability.Fixed in 1.83.1 - Configuration
Ensure receive buffer compaction is enabled (this behavior is enabled by default); if previously disabled, set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION to true to mitigate the remote DoS.
gRPC Go GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION = true - Compensating control
If unforeseen issues arise, temporarily disable receive buffer compaction by setting environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false; note this escape hatch will be removed in a future release.
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker that can establish a gRPC connection can exploit it by sending a stream fragmented into very many tiny HTTP/2 DATA frames. Multiple concurrent streams can be multiplexed to increase memory consumption.
Are default configurations affected?
Receive buffer compaction, the mitigation described for this issue, is enabled by default. It coalesces consecutive small buffers when per-frame overhead becomes excessive relative to payload data.
What is the remediation?
Upgrade to gRPC-Go 1.83.1, which includes the published fix. The fix was also merged into the master branch.
What can happen if exploitation succeeds?
Per-frame tracking and queue allocations can consume excessive heap memory despite the payload remaining within configured connection and stream flow-control windows. This can cause a runtime panic or an out-of-memory condition, resulting in remote denial of service.