@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.
Summary
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grpc | grpc-node | 1.10.0 to before 1.10.9; 1.9.0 to before 1.9.15; before 1.8.22 | 1.10.9, 1.9.15, 1.8.22 | Patch available | CNA |
| — | @grpc/grpc-js (npm) | 1.10.0 to before 1.10.9 | 1.10.9 | Patch available | GHSA-7v5v-9h63-cj86 |
| — | @grpc/grpc-js (npm) | 1.9.0 to before 1.9.15 | 1.9.15 | Patch available | GHSA-7v5v-9h63-cj86 |
| — | @grpc/grpc-js (npm) | before 1.8.22 | 1.8.22 | Patch available | GHSA-7v5v-9h63-cj86 |
- grpc-node Vendorgrpc Affected 1.10.0 to before 1.10.9; 1.9.0 to before 1.9.15; before 1.8.22 Fixed in 1.10.9, 1.9.15, 1.8.22 Patch available CNA
- @grpc/grpc-js (npm) Vendor— Affected 1.10.0 to before 1.10.9 Fixed in 1.10.9 Patch available GHSA-7v5v-9h63-cj86
- @grpc/grpc-js (npm) Vendor— Affected 1.9.0 to before 1.9.15 Fixed in 1.9.15 Patch available GHSA-7v5v-9h63-cj86
- @grpc/grpc-js (npm) Vendor— Affected before 1.8.22 Fixed in 1.8.22 Patch available GHSA-7v5v-9h63-cj86
Remediation
- Fix · CNA grpc-node (grpc) Fixed in 1.10.9, 1.9.15, 1.8.22
- Fix · GHSA-7v5v-9h63-cj86 @grpc/grpc-js (npm) Fixed in 1.10.9 Advisory →
- Fix · GHSA-7v5v-9h63-cj86 @grpc/grpc-js (npm) Fixed in 1.9.15 Advisory →
- Fix · GHSA-7v5v-9h63-cj86 @grpc/grpc-js (npm) Fixed in 1.8.22 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat Developer Hub 1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37168
- 2026-10-03 Alias added: GHSA-7v5v-9h63-cj86
- 2026-10-27 Affected versions changed · Red Hat
References
Other 5
- https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86
- https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650
- https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3
- https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
- https://github.com/grpc/grpc-node
More grpc vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-25614 gRPC-Go has an authorization bypass via missing leading slash in :path CVSS 3.1CRITICAL 9.1
- TI-2020-06285 Prototype pollution in grpc CVSS 3.1CRITICAL 9.8
- TI-2017-05916 Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based… CVSS 3.0CRITICAL 9.8
- TI-2017-05476 Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
- TI-2017-06843 Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-37168 · CVE Program
- CVE-2024-37168 · NVD
- FIRST EPSS
- GHSA-7v5v-9h63-cj86 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-37168 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences