In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).
This is fixed in the 4.5.10 version.
Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
References
| Link | Resource |
|---|---|
| https://gitlab.eclipse.org/security/cve-assignement/-/issues/31 | Issue Tracking Vendor Advisory |
| https://github.com/eclipse-vertx/vertx-grpc/issues/113 | Issue Tracking |
Configurations
History
12 Sep 2024, 16:44
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-770 | |
| References | () https://gitlab.eclipse.org/security/cve-assignement/-/issues/31 - Issue Tracking, Vendor Advisory | |
| References | () https://github.com/eclipse-vertx/vertx-grpc/issues/113 - Issue Tracking | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Eclipse vert.x
Eclipse |
|
| CPE | cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:* |
04 Sep 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-04 16:15
Updated : 2024-09-12 16:44
NVD link : CVE-2024-8391
Mitre link : CVE-2024-8391
JSON object : View
Products Affected
eclipse
- vert.x
CWE
CWE-770
Allocation of Resources Without Limits or Throttling