grpc_server streaming requests exhaust memory and can crash the node
A communication part built into programs can make servers crash.
Summary
grpc_server does not enforce its request size limit on streaming calls. An unauthenticated remote attacker can send an oversized request in small pieces, use up the server's memory, and crash the node. Versions from 1.0.0 before 1.0.6 are affected.
Affected when
- A service exposing at least one streaming RPC method
What to do
Update grpc_server to 1.0.6.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
Times
First published
First seen