Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HPACK table poisoning in gRPC C++, Python & Ruby
Vulnerability Description
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
CVSS Information
N/A
Vulnerability Type
预期行为违背
Vulnerability Title
gRPC 安全漏洞
Vulnerability Description
gRPC是gRPC开源的一种现代、开源、高性能的远程过程调用 (RPC) 框架。 gRPC存在安全漏洞，该漏洞源于错误编码标头的错误状态在标头读取之间未清除，可能泄露其他客户端的HTTP标头键。
CVSS Information
N/A
Vulnerability Type
N/A