Skip to main content

GHSA-m425-mq94-257g

CVE Details

GHSA-m425-mq94-257g

Last Update

10/25/2023

NIST CVE Summary

The affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit.

Our Official Summary

CVE exists in coredns that’s being used in k8s 1.28.11. Affects only k8s version 1.28.11. For customer workload clusters, workaround is to use k8s version 1.29+. For Palette Self Hosted cluster, a future release will upgrade to 1.29+.

CVE Severity

7.5

Status

Ongoing