id: GO-2023-2153
modules:
    - module: google.golang.org/grpc
      versions:
        - fixed: 1.56.3
        - introduced: 1.57.0
          fixed: 1.57.1
        - introduced: 1.58.0
          fixed: 1.58.3
      vulnerable_at: 1.58.2
      packages:
        - package: google.golang.org/grpc/internal/transport
          symbols:
            - NewServerTransport
        - package: google.golang.org/grpc
          symbols:
            - Server.initServerWorkers
          derived_symbols:
            - NewServer
            - Server.Serve
summary: Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc
description: |-
    An attacker can send HTTP/2 requests, cancel them, and send subsequent requests.
    This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to
    launch more concurrent method handlers than the configured maximum stream limit,
    grpc.MaxConcurrentStreams. This results in a denial of service due to resource
    consumption.
ghsas:
    - GHSA-m425-mq94-257g
related:
    - CVE-2023-44487
references:
    - web: https://github.com/grpc/grpc-go/pull/6703
    - fix: https://github.com/grpc/grpc-go/commit/f2180b4d5403d2210b30b93098eb7da31c05c721