- Reported
-
- Issued
-
- Package
-
connectrpc
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#http2
#grpc
#streaming
#resource-exhaustion
- Aliases
-
- References
-
- CVSS Score
- 6.3
MEDIUM
- CVSS Details
-
- Attack Complexity
- Low
- Attack Requirements
- Present
- Attack Vector
- Network
- Privileges Required
- None
- Availability Impact to the Subsequent System
- None
- Confidentiality Impact to the Subsequent System
- None
- Integrity Impact to the Subsequent System
- None
- User Interaction
- None
- Availability Impact to the Vulnerable System
- Low
- Confidentiality Impact to the Vulnerable System
- None
- Integrity Impact to the Vulnerable System
- None
- CVSS Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Patched
-
- Unaffected
-
Description
Affected versions of connectrpc start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request stream, an interceptor can reject the call, or the request timeout can fire. The background task then keeps reading, with no time limit. If the client stops sending part-way through a message, or never sends the rest, the task, the partial message it has buffered (up to max_message_size, 4 MiB by default) and the HTTP/2 stream, or the HTTP/1.x connection, are held until the client finishes the stream or closes the connection.
Impact
A client can use this to exhaust the memory, tasks and file descriptors of a server. With the default limits of the built-in Server, one HTTP/2 connection can hold 200 stalled streams, about 800 MiB at the default message size, and the server does not limit the number of connections. A server that authenticates in Tower middleware, before the request reaches the service, is exposed only to callers with a valid credential. A server with no authentication, or one that authenticates in an interceptor, is exposed to any client. This advisory covers client-streaming and bidirectional-streaming calls only.
Patches
Versions 0.8.2 and 0.9.1 bound the wait. When the handler is gone, the reader frees the partial message and discards the rest of the body for at most 5 seconds and 1 MiB, then drops it, which resets the HTTP/2 stream or closes the HTTP/1.x connection. On wasm32, which has no clock, only the 1 MiB limit applies. Versions 0.2.0 to 0.7.0 contain the same reader and are not patched; upgrade to 0.8.2 or later.
Workarounds
Authenticate in Tower middleware rather than in an interceptor, so a request without a credential is rejected before any reader starts. Set Server::with_max_connection_age, which closes each connection, and every stalled body on it, once its age and the grace period have passed. Lowering Limits::with_max_message_size and Server::with_max_concurrent_streams reduces what one client can hold but does not release a stalled body.
Advisory available under CC0-1.0
license.