high7.5
CVE-2024-8391
Vertx gRPC server does not limit the maximum message size
Impact
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client). This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.vertx:vertx-grpc-server | >= 4.3.0, < 4.5.10 | 4.5.10 |
| maven | io.vertx:vertx-grpc-client | >= 4.3.0, < 4.5.10 | 4.5.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Vert.X | from 4.3.0 before 4.5.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/eclipse-vertx/vertx-grpc/issues/113
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/31
- https://github.com/advisories/GHSA-g76f-gjfx-4rpr
- https://nvd.nist.gov/vuln/detail/CVE-2024-8391
- https://github.com/eclipse-vertx/vertx-grpc/commit/a76b14a92410c89fcc590c5852d800b565916ccf