gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:
- Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser
The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.
The unbounded memory buffering bugs:
- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade rhc-worker-playbook-debuginfoUpgrade rhc-worker-playbook | Feb 10, 2025 | Aug 9, 2023 |
| Suse | — | Upgrade opencensus-proto-sourceUpgrade python311-protobufUpgrade libprotobuf-lite25_1_0Upgrade libprotobuf25_1_0-32bitUpgrade grpc-develUpgrade re2-develUpgrade libupb37Upgrade libprotobuf25_1_0Upgrade upb-develUpgrade python311-abseilUpgrade libabsl2308_0_0Upgrade libprotobuf-lite25_1_0-32bitUpgrade libre2-11Upgrade protobuf-javaUpgrade abseil-cpp-develUpgrade grpc-sourceUpgrade protobuf-develUpgrade libabsl2308_0_0-32bitUpgrade libre2-11-32bitUpgrade libprotoc25_1_0-32bitUpgrade libgrpc++1_60Upgrade python311-grpcioUpgrade libgrpc1_60Upgrade libprotoc25_1_0Upgrade libgrpc37 | Feb 22, 2024 | Aug 9, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub