gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:
- Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser
The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.
The unbounded memory buffering bugs:
- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade grpc | Jan 10, 2024 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade rhc-worker-playbook-debuginfoUpgrade rhc-worker-playbook | Feb 10, 2025 | Aug 9, 2023 |
| Suse | — | Upgrade python311-protobufUpgrade libprotobuf-lite25_1_0Upgrade opencensus-proto-sourceUpgrade libupb37Upgrade re2-develUpgrade grpc-develUpgrade libabsl2308_0_0Upgrade libre2-11Upgrade python311-abseilUpgrade libprotobuf25_1_0Upgrade libprotobuf-lite25_1_0-32bitUpgrade upb-develUpgrade libprotobuf25_1_0-32bitUpgrade grpc-sourceUpgrade libprotoc25_1_0-32bitUpgrade protobuf-develUpgrade libprotoc25_1_0Upgrade libgrpc1_60Upgrade libgrpc++1_60Upgrade python311-grpcioUpgrade protobuf-javaUpgrade libgrpc37Upgrade libabsl2308_0_0-32bitUpgrade abseil-cpp-develUpgrade libre2-11-32bit | Feb 22, 2024 | Aug 9, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub