REDHAT-BUG-2526955: High severity gRPC gRPC-Go vulnerability
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPCGOEXPERIMENTALENABLERECEIVEBUFFERCOMPACTION. This issue is fixed in version 1.83.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gRPC-Goto a version that resolves this vulnerability.Fixed in 1.83.1