Am I affected?

type your grpc version to check

Description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body.

'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node.

This issue affects grpc from 0.3.1 before 1.0.0.

Weaknesses & attack patterns

Weakness

CWE-770 · Allocation of Resources Without Limits or Throttling in catalog → MITRE ↗

Attack patterns

CAPEC-130 · Excessive Allocation MITRE ↗
CAPEC-231 · Oversized Serialized Data Payloads MITRE ↗

Affected — Hex / grpc Hex.pm ↗ Repository ↗

0.3.1 < 1.0.0 affected
every other version: unaffected
default status unaffected
cpe cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*
modules · source files · routines
modules 'Elixir.GRPC.Server.Adapters.Cowboy.Handler'
source files lib/grpc/server/adapters/cowboy/handler.ex
routines 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3

Affected — GitHub / elixir-grpc/grpc Repository ↗

d1abe70 < 49e18c3 affected
every other version: unaffected
default status unaffected
cpe cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*
modules · source files · routines
modules 'Elixir.GRPC.Server.Adapters.Cowboy.Handler'
source files lib/grpc/server/adapters/cowboy/handler.ex
routines 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3

References

Credits

Peter Ullrich Finder
Paulo Valente Remediation developer
Jonatan Männchen Analyst

CVSS breakdown

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
« All CVEs