Uncontrolled Resource Consumption ('Resource Exhaustion') Affecting github.com/mostynb/go-grpc-compression/internal/zstd package, versions >=1.1.4 <1.2.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMMOSTYNBGOGRPCCOMPRESSIONINTERNALZSTD-7247335
- published12 Jun 2024
- disclosed10 Jun 2024
- creditMiroslav Stampar
Introduced: 10 Jun 2024
CVE NOT AVAILABLE CWE-400 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/mostynb/go-grpc-compression/internal/zstd to version 1.2.3 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') through the Decoder.DecodeAll function. An attacker can cause rapid memory usage increases by sending specially crafted gRPC requests.
Note: This is only exploitable if attackers can send gRPC payloads to users of the affected libraries.
Workaround
Other compression formats were not affected, users may consider switching from zstd to another format without upgrading to a newer release.