GHSA-m425-mq94-257g gRPC-Go HTTP/2 Rapid Reset vulnerability

• Go google.golang.org/grpc: < 1.56.3 → fixed in 1.56.3 • Go google.golang.org/grpc: >= 1.57.0, < 1.57.1 → fixed in 1.57.1 • Go google.golang.org/grpc: >= 1.58.0, < 1.58.3 → fixed in 1.58.3

Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit. Patches This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0. Along with applying the patch, users should also ensure they are using the `grpc.MaxConcurrentStreams` server option to apply a limit to the server's resources used for any single connection. Workarounds None. References 6703