Threats tagged 'ghsa-cvqv-jpx4-mgc8'

Apache bRPC versions prior to 1.18.0 have an uncontrolled resource consumption vulnerability in the HTTP/2 receive path. This flaw allows remote unauthenticated attackers to crash the server or cause unbounded memory growth by sending specially crafted HTTP/2 frames. The issue arises because the server does not enforce advertised HTTP/2 limits such as max concurrent streams and max header list size, and control-frame acknowledgments bypass write caps. The vulnerability affects any bRPC server or client using HTTP/2/gRPC on untrusted networks. Upgrading to version 1.18.0 or later or applying the referenced patch mitigates the issue by enforcing these limits.