GHSA-m425-mq94-257g GO-2023-2153
gRPC-Go HTTP/2 Rapid Reset vulnerability
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 100.00%
- Chance of exploitation in the next 30 days. Higher than 100.00% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog
- Weakness
- —
- Not classified
- Fix
1.56.3- Upgrade google.golang.org/grpc to this version or later
Description
Impact
In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit.
Patches
This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0.
Along with applying the patch, users should also ensure they are using the grpc.MaxConcurrentStreams server option to apply a limit to the server's resources used for any single connection.
Workarounds
None.
References
#6703
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| google.golang.org/grpc | < 1.56.3 |
1.56.3 |
| google.golang.org/grpc | >= 1.57.0, < 1.57.1 |
1.57.1 |
| google.golang.org/grpc | >= 1.58.0, < 1.58.3 |
1.58.3 |
| google.golang.org/grpc | < 1.56.3>= 1.57.0, < 1.57.1>= 1.58.0, < 1.58.3 |
1.56.31.57.11.58.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
google.golang.org/grpc Go → 1.56.3
- go
go get google.golang.org/grpc@v1.56.3 && go mod tidy
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack | Medium Known exploited | Linked by the source |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers | High | Also affects google.golang.org/grpc |
| GHSA-vp52-pcj8-j9qc gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation | High | Also affects google.golang.org/grpc |
| GHSA-qc2q-p7wx-3px3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion | Medium | Also affects google.golang.org/grpc |
| GHSA-hrxh-6v49-42gf gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities | High | Also affects google.golang.org/grpc |
| GHSA-p77j-4mvh-x3m3 gRPC-Go has an authorization bypass via missing leading slash in :path | Critical | Also affects google.golang.org/grpc |
| GHSA-xr7q-jx4m-x55m Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go | Low | Also affects google.golang.org/grpc |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor