gRPC Security Vulnerabilities

🗓️ 10 Jun 2024 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 1 Views

Security flaw in rpc framework before versions 1.10.9, 1.9.15, and 1.8.22 allows memory overallocation.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js and packages affect IBM Voice Gateway	17 Sep 202421:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses grpc-js-1.8.21.tgz which is vulnerable to CVE-2024-37168	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.17 and earlier	4 Jul 202415:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	6 Jan 202605:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a local authenticated attack and denial of service due to Microsoft Azure Identity Libraries and Microsoft Authentication Library and gRPC on Node.js (CVE-2024-35255, CVE-2024-37168)	22 Jul 202415:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202503:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2024-37168] [CVE-2024-34890]	23 Aug 202410:03	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	14 Aug 202409:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to denial of service vulnerability in gRPC on Node.js [CVE-2024-37168]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in grpc-js-1.7.3.tgz	22 Oct 202511:23	–	ibm

Source	Link
github	www.github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86
github	www.github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650
github	www.github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3
github	www.github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
cxsecurity	www.cxsecurity.com/cveshow/CVE-2024-37168/

30 Dec 2025 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3

EPSS0.00283

SSVC

rpc framework memory overallocation vulnerable versions version 1.10.9 version 1.9.15 version 1.8.22