CVE-2022-24777CWE-617

Denial of Service via reachable assertion in grpc-swift

High · published March 25, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01177 · 67.4th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2022-03-25T16:35Z
EPSS history
Timeline
  • 25 MAR 16:35Z
    Denial of Service via reachable assertion in grpc-swift
    cvelistv5