CVE-2024-7246 HPACK table poisoning in gRPC C++, Python & Ruby
Attackers can poison HPACK tables to leak HTTP header keys and cause request failures in gRPC clients communicating via HTTP/2 proxies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-7246?
CVE-2024-7246 is a medium-severity vulnerability in Google gRPC, published on 6 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values.
This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table.
Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
Weakness: CWE-440
Which versions are affected by CVE-2024-7246?
It affects 1 product.
Products include Grpc Grpc.
How do I fix CVE-2024-7246?
Upgrade to a fixed version.
Is CVE-2024-7246 being exploited?
There is no known exploitation of CVE-2024-7246 in the wild and no public exploit code.
Other vulnerabilities in Google gRPC
Sources
Also known as AZL-47442, AZL-47571, BELL-CVE-2024-7246, DEBIAN-CVE-2024-7246, ECHO-776e-6420-85f8, GHSA-ghwg-gpp4-w4x3 and 2 more.