Read the docs
TI-2023-30829 Aliases GHSA-m425-mq94-257g

gRPC-Go HTTP/2 Rapid Reset vulnerability

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit. ### Patches This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0. Along with applying the patch, users should also ensure they are using the `grpc.MaxConcurrentStreams` server option to apply a limit to the server's resources used for any single connection. ### Workarounds None. ### References #6703

Why it matters now

Fix Fixed google.golang.org/grpc (Go): 1.56.3, 1.57.1, 1.58.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—google.golang.org/grpc (Go)before 1.56.31.56.3Patch availableGHSA-m425-mq94-257g
—google.golang.org/grpc (Go)1.57.0 to before 1.57.11.57.1Patch availableGHSA-m425-mq94-257g
—google.golang.org/grpc (Go)1.58.0 to before 1.58.31.58.3Patch availableGHSA-m425-mq94-257g
  • google.golang.org/grpc (Go) Vendor— Affected before 1.56.3 Fixed in 1.56.3 Patch available GHSA-m425-mq94-257g
  • google.golang.org/grpc (Go) Vendor— Affected 1.57.0 to before 1.57.1 Fixed in 1.57.1 Patch available GHSA-m425-mq94-257g
  • google.golang.org/grpc (Go) Vendor— Affected 1.58.0 to before 1.58.3 Fixed in 1.58.3 Patch available GHSA-m425-mq94-257g

Remediation

  • Fix · GHSA-m425-mq94-257g google.golang.org/grpc (Go) Fixed in 1.56.3 Advisory →
  • Fix · GHSA-m425-mq94-257g google.golang.org/grpc (Go) Fixed in 1.57.1 Advisory →
  • Fix · GHSA-m425-mq94-257g google.golang.org/grpc (Go) Fixed in 1.58.3 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-m425-mq94-257g

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences