gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:
- Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser
The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.
The unbounded memory buffering bugs:
- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade rhc-worker-playbookUpgrade rhc-worker-playbook-debuginfo | Feb 10, 2025 | Aug 9, 2023 |
| Suse | — | Upgrade grpc-sourceUpgrade protobuf-develUpgrade libprotoc25_1_0Upgrade libprotoc25_1_0-32bitUpgrade libabsl2308_0_0-32bitUpgrade libgrpc37Upgrade abseil-cpp-develUpgrade libgrpc1_60Upgrade protobuf-javaUpgrade libre2-11-32bitUpgrade python311-grpcioUpgrade libgrpc++1_60Upgrade grpc-develUpgrade libabsl2308_0_0Upgrade python311-abseilUpgrade libprotobuf-lite25_1_0-32bitUpgrade libre2-11Upgrade libupb37Upgrade libprotobuf25_1_0Upgrade re2-develUpgrade libprotobuf-lite25_1_0Upgrade python311-protobufUpgrade opencensus-proto-sourceUpgrade libprotobuf25_1_0-32bitUpgrade upb-devel | Feb 22, 2024 | Aug 9, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub