CyberRota Analysis
AI-GeneratedThe vulnerability affects the gRPC-Go implementation in Windows, where an unauthenticated remote attacker can exploit the handling of fragmented HTTP/2 DATA frames to consume excessive heap memory, potentially leading to a runtime panic or out-of-memory termination. Organizations utilizing gRPC-Go versions prior to 1.83.1 should prioritize this issue to mitigate the risk of service disruption due to memory exhaustion. Immediate upgrades to version 1.83.1 or later are recommended to address this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.