| Package | Affected versions | Patched versions |
|---|---|---|
| google.golang.org/grpc | ≥ 1.57.0, < 1.57.1≥ 1.58.0, < 1.58.3< 1.56.3 | 1.57.11.58.31.56.3 |
An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free