High · 7.5 CVE-2021-36155 EUVD-2023-1886GHSA-rxmj-hg9v-vp3p

Uncontrolled Resource Consumption in LengthPrefixedMessageReader

Published Jul 9, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: github.com/grpc/grpc-swift Ecosystem: SwiftURL

Description

LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource consumption and deny service.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
SwiftURL	github.com/grpc/grpc-swift	< 1.2.0	1.2.0	GHSA-rxmj-hg9v-vp3p

References

https://github.com/grpc/grpc-swift/releases
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35303
https://github.com/grpc/grpc-swift/security/advisories/GHSA-rxmj-hg9v-vp3p