SB2026090261 - Multiple vulnerabilities in gRPC

Description

This security bulletin contains information about 3 vulnerabilities.

1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the decompression logic when processing a crafted compressed message. A remote attacker can send a crafted zip bomb message to cause a denial of service.

2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in GOAWAY frame parsing in the HTTP/2 transport when handling a crafted GOAWAY frame header. A remote attacker can send a GOAWAY frame header with a large payload length to cause a denial of service.

The large allocation can be triggered even if the payload itself is not sent.

3) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in HTTP/2 DATA frame handling when fragmenting stream payloads into many tiny frames. A remote attacker can initiate a gRPC stream and send payload data fragmented into many tiny HTTP/2 DATA frames to cause a denial of service.

An attacker can amplify memory consumption further by multiplexing multiple concurrent streams.

Remediation

Install update from vendor's website.

References

• https://github.com/grpc/grpc/security/advisories/GHSA-hf3w-6hpw-qp67