#1088806 grpc: CVE-2024-11407

Package:
src:grpc
Source:
src:grpc
Submitter:
Moritz Mühlenhoff
Date:
2026-05-07 09:05:02 UTC
Severity:
normal
Tags:
#1088806#5
Date:
2024-12-01 16:35:08 UTC
From:
To:
Hi,

The following vulnerability was published for grpc.

CVE-2024-11407[0]:
| There exists a denial of service through Data corruption in gRPC-C++
| - gRPC-C++ servers with transmit zero copy enabled through the
| channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data
| corruption issues. The data sent by the application may be corrupted
| before transmission over the network thus leading the receiver to
| receive an incorrect set of bytes causing RPC requests to fail. We
| recommend upgrading past
| commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 (v1.68.0-pre1)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-11407
https://www.cve.org/CVERecord?id=CVE-2024-11407

Please adjust the affected versions in the BTS as needed.