Denial Of Service (DoS)

2023-07-1307:39:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0005 Low

EPSS

Percentile

16.0%

JSON

grpc is vulnerable to Denial Of Service (DoS). The vulnerability exists due to improper header validation which allows an attacker to send headers such as te: x (x != trailers), scheme: x (x != http, https), and grpclb_client_stats: x (x == anything), leading to the total header size being over 8kb, resulting in an application crash.

CPENameOperatorVersion
grpciole1.52.0
grpcle1.52.2
grpc.net.clientle2.51.0
grpc.net.client.weble2.51.0
io.grpc:grpc-xdsle1.52.1
grpcle1.52.0
libgrpc.sole30.0.0
grpciole1.52.0
grpcle1.52.2
grpc.net.clientle2.51.0

Name	Operator	Version
grpcio	le	1.52.0
grpc	le	1.52.2
grpc.net.client	le	2.51.0
grpc.net.client.web	le	2.51.0
io.grpc:grpc-xds	le	1.52.1
grpc	le	1.52.0
libgrpc.so	le	30.0.0
grpcio	le	1.52.0
grpc	le	1.52.2
grpc.net.client	le	2.51.0