CVE-2024-8391CWE-770

Eclipse Vert.x gRPC server does not limit the maximum message size

Medium · published September 4, 2024

CVSS v4.0
6.9
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).

This is fixed in the 4.5.10 version.

Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00580 · 47.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-09-04T15:27Z
EPSS history
Timeline
  • 04 SEP 15:27Z
    Eclipse Vert.x gRPC server does not limit the maximum message size
    cvelistv5