CVE-2024-47609
Remotely exploitable DoS in Tonic `<=v0.12.2`
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 1, 2024
- Updated
- Nov 21, 2024
- Reserved
- Sep 27, 2024
Description
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green | GitHub_M |
Weaknesses
- CWE-755 Improper Handling of Exceptional Conditions
Affected Products
| Product | Versions |
|---|---|
tonichyperium |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.