GHSA-m425-mq94-257g

    Dashboard / Vulnerabilities / GHSA-m425-mq94-257g

    GHSA-m425-mq94-257g

    Published: 25 Oct 2023Last Modified: 10 Sept 2026
    Aliases:
    GO-2023-2153

    Summary: gRPC-Go HTTP/2 Rapid Reset vulnerability

    Details: ### Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit. ### Patches This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0. Along with applying the patch, users should also ensure they are using the `grpc.MaxConcurrentStreams` server option to apply a limit to the server's resources used for any single connection. ### Workarounds None. ### References #6703

    References: https://github.com/grpc/grpc-go/security/advisories/GHSA-m425-mq94-257g, https://nvd.nist.gov/vuln/detail/CVE-2023-44487, https://github.com/grpc/grpc-go/pull/6703, https://github.com/grpc/grpc-go/commit/f2180b4d5403d2210b30b93098eb7da31c05c721, https://github.com/grpc/grpc-go

    Affected packages

    Package

    Name: google.golang.org/grpc

    Purl: pkg:golang/google.golang.org/grpc

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.56.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-m425-mq94-257g | CVE-DB