Loading vulnerability…
Unbounded Message Size DoS in Eclipse Vert.x gRPC
CVE-2024-8391 is an uncontrolled resource-allocation vulnerability in Eclipse Vert.x gRPC versions 4.3.0 through 4.5.9. The affected Vert.x gRPC client and server components do not enforce a maximum gRPC message-payload length, allowing a peer to submit arbitrarily large messages for processing. The grpc-java and Netty-based Vert.x gRPC implementation is not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to send requests to an affected gRPC service can cause excessive memory and potentially CPU consumption by transmitting oversized payloads. This can degrade service availability or cause denial of service.
If you can’t patch tonight, do this now.
Until the upgrade is deployed, restrict access to exposed gRPC endpoints through network segmentation and authentication/authorization controls. Enforce request or message-size limits at an upstream reverse proxy, load balancer, API gateway, or service mesh where supported, so oversized payloads do not reach the application.
Patch, then assume compromise.
Upgrade the affected Eclipse Vert.x gRPC client and server components to version 4.5.10 or later, which enforces the message-size limitation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.