CVE-2021-36155

Vulnerability

LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier (including 1.0.0, 1.1.0, and 1.1.1) does not limit the permitted length of received messages, allowing remote attackers to trigger allocation of arbitrarily large buffers, which causes uncontrolled resource consumption. The vulnerable code path is reachable in both client and server configurations when parsing gRPC messages [1][2].

Exploitation

An attacker with network access to a gRPC Swift endpoint (either as a client or server) can send a specially crafted message with an excessively large length prefix. The LengthPrefixedMessageReader processes the message and allocates a buffer of the declared size without validation, leading to memory exhaustion. No authentication or special privileges are required [1][2].

Impact

Successful exploitation results in denial of service due to exhaustion of memory resources on the target system. The attacker can cause the application to become unresponsive or crash, disrupting availability [1][2].

Mitigation

The issue is fixed in gRPC Swift version 1.2.0, which limits the permitted length of received messages [2][4]. No workaround is available; users must upgrade to the patched version [2]. The 1.x series is in maintenance mode, but security fixes are still applied [3].