Vertx gRPC server does not limit the maximum message size
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client). This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-8391US | high7.5 | — | ||
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/eclipse-vertx/vertx-grpcWEB
- https://github.com/eclipse-vertx/vertx-grpc/commit/a76b14a92410c89fcc590c5852d800b565916ccfWEB
- https://github.com/eclipse-vertx/vertx-grpc/issues/113WEB
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/31WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-8391ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan