Linuxfoundation Grpc Swift vulnerabilities

4 CVEs affecting Linuxfoundation Grpc Swift, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-24777, published 2022-03-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-36155, published 2021-07-09. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource consumption and deny service.
CVE-2021-36154, published 2021-07-09. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/2 frame, leading to Uncontrolled…
CVE-2021-36153, published 2021-07-09. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malformed requests.
CVE-2022-24777, published 2022-03-25. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a…