~ / search / GHSA-g76f-gjfx-4rpr

GHSA-g76f-gjfx-4rpr

Vertx gRPC server does not limit the maximum message size

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-8391

Packages

EcosystemPackageAffectedFixed in
Maven io.vertx:vertx-grpc-server >= 4.3.0, < 4.5.10 4.5.10
Maven io.vertx:vertx-grpc-client >= 4.3.0, < 4.5.10 4.5.10

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).  This is fixed in the 4.5.10 version.  Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

References

External links from the advisory. They lead to third-party sites.