CVE-2024-8391
Eclipse Vert.x gRPC server does not limit the maximum message size
Summary
Eclipse Vert.x gRPC server does not limit the maximum message size
Original description
The description as published by the source.
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).
This is fixed in the 4.5.10 version.
Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- report github.com
- report gitlab.eclipse.org
- web repo.maven.apache.org