Connection Termination

2023-07-1310:09:03

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

grpc

http2

proxy

base64 encoding

application crash

0.001 Low

EPSS

Percentile

31.8%

JSON

grpc is vulnerable to Connection Termination. An attacker can terminate the connection between a HTTP2 proxy and the gRPC server by providing a -bin suffixed headers, which leads to a base64 encoding error, causing an application crash.

CPENameOperatorVersion
grpciole1.52.0
grpcle1.52.2
grpc.net.clientle2.51.0
io.grpc:grpc-xdsle1.52.1
grpcle1.53.0
libgrpc.sole31.0.0
grpciole1.52.0
grpcle1.52.2
grpc.net.clientle2.51.0
io.grpc:grpc-xdsle1.52.1

Name	Operator	Version
grpcio	le	1.52.0
grpc	le	1.52.2
grpc.net.client	le	2.51.0
io.grpc:grpc-xds	le	1.52.1
grpc	le	1.53.0
libgrpc.so	le	31.0.0
grpcio	le	1.52.0
grpc	le	1.52.2
grpc.net.client	le	2.51.0
io.grpc:grpc-xds	le	1.52.1