grpc/grpc-swift · Security
Uncontrolled Resource Consumption in LengthPrefixedMessageReader
- GHSA ID
- GHSA-rxmj-hg9v-vp3p
- CVE ID
- CVE-2021-36155
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Impact
Affected gRPC Swift clients and servers are vulnerable to uncontrolled resource consumption attacks. Excessive memory may be allocated when parsing messages. This can lead to a denial of service.
Patches
The problem has been fixed in 1.2.0.
Workarounds
No workaround is available. Users must upgrade.
CWEs
- CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-770 · Allocation of Resources Without Limits or Throttling