Vulnerability · Published Sep 4, 2024 · Assigned by eclipse
CVE-2024-8391Eclipse Vert.x gRPC server does not limit the maximum message size
Medium 6.9
In plain English
A medium-severity resource allocation without limits in Eclipse Vert.x from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client). This is fixed in the 4.5.10 version. Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.vertx:vertx-grpc-client | 4.5.10 | GHSA-g76f-gjfx-4rpr |
| Maven | io.vertx:vertx-grpc-server | 4.5.10 | GHSA-g76f-gjfx-4rpr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Vert.x | 4.3.0 – before 4.5.10 |
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N