CVE-2024-47609
Remotely exploitable DoS in Tonic `<=v0.12.2`
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Remotely exploitable DoS in Tonic `<=v0.12.2`
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
- Record
CVE-2024-47609- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green - Weakness
- CWE-755
- Updated
- 2026-11-02
EUVDEUVD-2024-2937
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
- Record
EUVD-2024-2937- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4jwc-w2hc-78qv
Tonic has remotely exploitable denial of service vulnerability
Impact
When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a tcp/tls stream. This can be triggered via causing the accept call to error out with errors there were not covered correctly causing the accept loop to exit.
More information can be found here
Patches
Upgrading to tonic 0.12.3 and above contains the fix.
Workarounds
A custom accept loop is a possible workaround.
- Record
GHSA-4jwc-w2hc-78qv- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-755
- Updated
- 2026-11-02
NVD
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
- Record
CVE-2024-47609- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green - Weakness
- CWE-755
- Updated
- 2026-11-02
OSV
Remotely exploitable DoS in Tonic `<=v0.12.2`
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
- Record
CVE-2024-47609- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green - Weakness
- CWE-755
- Updated
- 2026-11-02
OSVGHSA-4jwc-w2hc-78qv
Tonic has remotely exploitable denial of service vulnerability
Impact
When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a tcp/tls stream. This can be triggered via causing the accept call to error out with errors there were not covered correctly causing the accept loop to exit.
More information can be found here
Patches
Upgrading to tonic 0.12.3 and above contains the fix.
Workarounds
A custom accept loop is a possible workaround.
- Record
GHSA-4jwc-w2hc-78qv- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-755
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-47609
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
- Record
UBUNTU-CVE-2024-47609- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14440-1 No score
cargo-audit-advisory-db-20241030-1.1 on GA media
These are all security issues fixed in the cargo-audit-advisory-db-20241030-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14440-1- Updated
- 2026-11-02
OSVRUSTSEC-2024-0376 No score
Remotely exploitable Denial of Service in Tonic
Impact
When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a tcp/tls stream. This can be triggered via causing the accept call to error out with errors there were not covered correctly causing the accept loop to exit.
More information can be found here
Patches
Upgrading to tonic 0.12.3 and above contains the fix.
Workarounds
A custom accept loop is a possible workaround.
- Record
RUSTSEC-2024-0376- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
toniccrates.io |
0.12.2 to 0.12.2 | 0.12.3 |
toniccrates.io |
0.12.2 up to 0.12.3 | 0.12.3 |
rust-tonicUbuntu:25.10 |
All versions, plus listed versions 0.10.2+dfsg-120.12.3+dfsg-4 |
None known |
rust-tonicUbuntu:26.10 |
All versions, plus listed versions 0.12.3+dfsg-60.14.5+dfsg-10.14.5+dfsg-20.14.5+dfsg-4 |
None known |
rust-tonicUbuntu:26.04:LTS |
All versions, plus listed versions 0.12.3+dfsg-40.12.3+dfsg-50.12.3+dfsg-5build10.12.3+dfsg-6 |
None known |
cargo-audit-advisory-dbopenSUSE:Tumbleweed |
before 20241030-1.1 | 20241030-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47609 is a medium vulnerability (CVSS 6.9) in Hyperium Tonic, published October 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in tonic 0.12.3.
References
github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qv
nvd.nist.gov/vuln/detail/CVE-2024-47609
rustsec.org/advisories/RUSTSEC-2024-0376.html
Show 7 moreShow less
crates.io/crates/tonic
ubuntu.com/security/CVE-2024-47609
cve.org/CVERecord?id=CVE-2024-47609
lists.opensuse.org/archives/list/[email protected]/thread/EFF7ZCD4SVHN2LLVZT4B6GOMX4FZDCHZ
suse.com/security/cve/CVE-2024-47609