CVE-2024-8391 Eclipse Vert.x gRPC server does not limit the maximum message size
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-8391?
CVE-2024-8391 is a medium-severity vulnerability in Eclipse Vert.x, published on 4 Sep 2024.
Official description
In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).
This is fixed in the 4.5.10 version.
Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)
Weakness: CWE-770
Which versions are affected by CVE-2024-8391?
4 open source packages ship an affected version, including io.vertx:vertx-grpc-client and io.vertx:vertx-grpc-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.vertx:vertx-grpc-client Maven | From 4.3.0 | 4.5.10 |
io.vertx:vertx-grpc-client Maven | From 4.3.0 | 4.5.10 |
io.vertx:vertx-grpc-server Maven | From 4.3.0 | 4.5.10 |
io.vertx:vertx-grpc-server Maven | From 4.3.0 | 4.5.10 |
Products include Eclipse Vert.x.
How do I fix CVE-2024-8391?
Upgrade io.vertx:vertx-grpc-client to 4.5.10 or later.
Is CVE-2024-8391 being exploited?
There is no known exploitation of CVE-2024-8391 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Vert.x
- CVE-2019-17640 Path Traversal in Eclipse Vert
- CVE-2018-12542 Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
- CVE-2018-12544 Moderate severity vulnerability that affects io.vertx:vertx-core
- CVE-2026-102469 Deserialization in Eclipse Vert.x
- CVE-2018-12540 High severity vulnerability that affects io.vertx:vertx-web
Sources
Also known as GHSA-g76f-gjfx-4rpr.