swifturl github.com/grpc/grpc-swift vulnerabilities

Latest swifturl github.com/grpc/grpc-swift CVEs

Newest publication first

1. CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

   Published 2022-03-25

   High·CVSS 7.5 EPSS 1.2%

   grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The att...

2. CVE-2021-36153 Incomplete Internal State Distinction in GRPCWebToHTTP2ServerCodec

   Published 2021-07-09

   High·CVSS 7.5 EPSS 2.1%

   Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malformed requests.

3. CVE-2021-36155 Uncontrolled Resource Consumption in LengthPrefixedMessageReader

   Published 2021-07-09

   High·CVSS 7.5 EPSS 2.1%

   LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource consumption and deny service.

4. CVE-2021-36154 Uncontrolled Recursion in HTTP2ToRawGRPCServerCodec

   Published 2021-07-09

   High·CVSS 7.5 EPSS 2.1%

   HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/2 frame, leading to Uncontrolled Recursion and stack consumption.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.