Riskcovery

CVE-2024-7246

HPACK table poisoning in gRPC C++, Python & Ruby

State
Published
Severity
6.3 Medium
Published
Aug 6, 2024
Updated
Aug 6, 2024
Reserved
Jul 29, 2024

Read the record on cve.org

Description

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values.

This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table.

Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:LGoogle

Weaknesses

  • CWE-440 Expected Behavior Violation

Affected Products

ProductVersions
gRPCGoogle
  • 1.53.0Affected
  • 1.53.1Affected
  • 1.53.2Affected
  • 1.54.0Affected
  • 1.54.1Affected
  • 1.54.3Affected
  • 1.55.0Affected
  • 1.55.1Affected
  • 1.55.3Affected
  • 1.55.4Affected
  • 1.56.0Affected
  • 1.56.1Affected
  • 1.56.2Affected
  • 1.56.3Affected
  • 1.56.4Affected
  • 1.57.0Affected
  • 1.57.1Affected
  • 1.58.0Affected
  • 1.58.1Affected
  • 1.58.2Affected
  • 1.59.0Affected
  • 1.59.1Affected
  • 1.59.2Affected
  • 1.59.3Affected
  • 1.59.4Affected
  • and 17 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.