GHSA-m425-mq94-257g
gRPC-Go HTTP/2 Rapid Reset vulnerability
Quick fix
GHSA-m425-mq94-257g — google.golang.org/grpc: upgrade to the fixed version with the command below.
go get google.golang.org/grpc@v1.56.3Details
### Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit.
### Patches This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0.
Along with applying the patch, users should also ensure they are using the `grpc.MaxConcurrentStreams` server option to apply a limit to the server's resources used for any single connection.
### Workarounds None.
### References #6703
Are you affected?
Enter the version of the package you're using.
Affected packages
1.57.0Fixed in: 1.57.1go get google.golang.org/grpc@v1.57.11.58.0Fixed in: 1.58.3go get google.golang.org/grpc@v1.58.3References
- https://github.com/grpc/grpc-go/security/advisories/GHSA-m425-mq94-257g[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487[ADVISORY]
- https://github.com/grpc/grpc-go/pull/6703[WEB]
- https://github.com/grpc/grpc-go/commit/f2180b4d5403d2210b30b93098eb7da31c05c721[WEB]
- https://github.com/grpc/grpc-go[PACKAGE]