High severity · published Jul 9, 2021
CVE-2021-36155
LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource consumption and…
7.5
CVSS
2.1%
EPSS
No
On KEV
Description
LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource consumption and deny service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
Grpc Swift · Linuxfoundation
1.0.0; 1.1.0; 1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-36155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-36155
Mailing List
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35303
Release Notes
https://github.com/grpc/grpc-swift/releases
Third Party Advisory
https://github.com/grpc/grpc-swift/security/advisories/GHSA-rxmj-hg9v-vp3p
More from Grpc Swift
7.5
CVE-2022-24777
grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework
7.5
CVE-2021-36154
HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/2 frame, leading to…
7.5
CVE-2021-36153
Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malformed requests