Medium, CVSS 6.3crates.ioAmendedPublished
Finished streaming calls keep reading a stalled request body indefinitely
GHSA-jx5x-3mcr-qp8r
- Affected
- crates.io connectrpc >= 0.2.0, < 0.8.2; >= 0.9.0, < 0.9.1
- Fixed in
- 0.8.20.9.1· Vendor fix available
- Issue
- Affected versions of `connectrpc` start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request stream, an interceptor can reject the call, or the request timeout can fire. The background task then keeps reading, with no time limit. If the client stops sending part-way through a message, or never sends the rest, the task, the partial message it has buffered (up to `max_message_size`, 4 MiB by default) and the HTTP/2 stream, or the HTTP/1.x connection, are held until the client finishes the stream or closes the connection. Impact A client can use this to exhaust the memory, tasks and file descriptors of a server. With the default limits of the built-in `Server`, one HTTP/2 connection can hold 200 stalled streams, about 800 MiB at the default message size, and the server does not…
Recommended action: Upgrade to 0.9.1 or 0.8.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.