grpc

Google’s widely used RPC stack has been rocked by a high‑impact denial‑of‑service flaw that can be triggered remotely against a range of gRPC deployments on POSIX platforms: CVE‑2023‑4785 arises from missing error handling in the gRPC TCP server and allows a remote attacker to exhaust server...

gRPC’s HPACK parser contains a set of parsing/accounting flaws that allow a remote, unauthenticated attacker to force excessive memory allocation, trigger pathological CPU use, and in practice cause connection termination or full denial-of-service of gRPC endpoints unless libraries and products...