Denial-of-Service in gRPC

CVE-2023-33953

What is CVE-2023-33953?

gRPC suffers from a vulnerability in its HPACK parser which might result in Denial of Service attacks through various vectors. Specifically, unbounded memory buffering and excessive CPU consumption can occur, potentially causing resources to be exhausted. Attackers can exploit this vulnerability using carefully crafted inputs, leading to significant disruptions in client-server communications. The extent of the issue is magnified by the faulty checks in the header size limits and the handling of infinite padding in varints. This makes the system highly susceptible to performance degradation under specific circumstances, allowing for severe operational impacts.

References