GHSA-m425-mq94-257g: gRPC-Go HTTP/2 Rapid Reset vulnerability

October 25, 2023 (updated July 19, 2024)

In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit.

References

github.com/advisories/GHSA-m425-mq94-257g
github.com/grpc/grpc-go
github.com/grpc/grpc-go/commit/f2180b4d5403d2210b30b93098eb7da31c05c721
github.com/grpc/grpc-go/pull/6703
github.com/grpc/grpc-go/security/advisories/GHSA-m425-mq94-257g
nvd.nist.gov/vuln/detail/CVE-2023-44487

Code Behaviors & Features

Detect and mitigate GHSA-m425-mq94-257g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →