{"id":"CVE-2024-11407","aliases":["AZL-53456","BELL-CVE-2024-11407","DEBIAN-CVE-2024-11407","EUVD-2024-33797","GHSA-p9rf-64qj-22rw","OESA-2024-2573","RHSA-2025:0340","RHSA-2025:1019","SUSE-SU-2024:4393-1","SUSE-SU-2024:4400-1","SUSE-SU-2024:4401-1","SUSE-SU-2024:4428-1","SUSE-SU-2024:4429-1","SUSE-SU-2024:4436-1","UBUNTU-CVE-2024-11407","openSUSE-SU-2025:15031-1"],"status":"published","title":"Denial of Service through Data corruption in gRPC-C++","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00572,"percentile":0.47758,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-682"],"published":"2024-11-26T16:59:49Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"grpc","fixed_in":["1.62.0-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"grpc","fixed_in":["1.71.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"grpc","fixed_in":["1.71.0-r0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"grpc","fixed_in":["1.60.0-5.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-grpcio","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-grpcio-debugsource","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-grpcio","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-grpcio-debuginfo","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python-grpcio","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python-grpcio-debugsource","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-grpcio","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-grpcio-debuginfo","fixed_in":["0:1.68.1-1.el8pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-grpcio","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-grpcio-debugsource","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-grpcio","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-grpcio-debuginfo","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python-grpcio","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python-grpcio-debugsource","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-grpcio","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]},{"ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-grpcio-debuginfo","fixed_in":["0:1.68.1-1.el9pc"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.62.0-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.59.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.56.0-r2"},{"fixed":"1.71.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.56.0-r2"},{"fixed":"1.71.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-10","1.51.1-6","1.51.1-7","1.51.1-8","1.51.1-9","1.59.5-1","1.82.0-1","1.83.0-1","1.83.0-2"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.0-5.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250115-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250115-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el8pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-grpcio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-grpcio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.1-1.el9pc"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1-150600.16.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1-150600.16.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.0-150400.8.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.0-150600.15.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.0-150600.15.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1-150400.9.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1-150500.12.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1-150500.12.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1-150500.12.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.0-150500.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.0-150500.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.0-150500.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.2-1","0.11.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-1","1.3.2-1ubuntu1","1.3.2-1.1~build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1","1.16.1-1ubuntu1","1.16.1-1ubuntu3","1.16.1-1ubuntu4","1.16.1-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30.2-3","1.30.2-3build1","1.30.2-3build3","1.30.2-3build5","1.30.2-3build6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-3build3","1.51.1-3build4","1.51.1-4","1.51.1-4build1","1.51.1-4build2","1.51.1-4.1build3","1.51.1-4.1build4","1.51.1-4.1build5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-6","1.51.1-6build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-8ubuntu1","1.51.1-9","1.51.1-9ubuntu3","1.51.1-10ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.51.1-6build1","1.51.1-7","1.51.1-7ubuntu2","1.51.1-7ubuntu3","1.51.1-8ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-grpcio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.69.0-2.1"}]}],"bundled":2}],"products":[{"vendor":"grpc","product":"grpc"},{"vendor":"grpc","product":"grpc-c++"}],"references":[{"url":"https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","tags":["Patch","fix","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11407","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p9rf-64qj-22rw"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-11407","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11407.json","tags":["advisory"]},{"url":"https://github.com/grpc/grpc","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-11407","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2573","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2327130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331063","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0340.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11407","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52304","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53907","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/dec/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53908","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-55565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-55565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55565","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/compare/3.3.7...3.3.8","tags":["article"]},{"url":"https://github.com/ai/nanoid/pull/510","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.0.9","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1019","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30266","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30284","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30286","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30287","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30288","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30291","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30292","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30295","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30296","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30297","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-30298","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1019.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244393-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228919","tags":["report"]},{"url":"https://bugzilla.suse.com/1233821","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7246","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244400-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244401-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244428-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244429-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244436-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-11407","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-11407","title":"Denial of Service through Data corruption in gRPC-C++","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T16:59:49.718Z","modified":"2024-11-26T21:04:58.031Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green","level":"medium","assessor":"cna"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:34:19.615831Z"}],"euvd":[{"id":"EUVD-2024-33797","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T16:59:49Z","modified":"2024-11-26T21:04:58Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green","level":"medium"}],"updated_at":"2026-11-03T00:04:46.096988Z"}],"ghsa":[{"id":"GHSA-p9rf-64qj-22rw","title":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with...","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T18:38:52Z","modified":"2025-07-23T21:37:47Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:03:06.773491Z"}],"nvd":[{"id":"CVE-2024-11407","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T17:15:22.83Z","modified":"2026-06-17T06:57:42.16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"BELL-CVE-2024-11407","status":"published","published":"2024-12-03T05:59:56.887663Z","modified":"2026-09-06T07:15:18.786742764Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-11407","title":"Denial of Service through Data corruption in gRPC-C++","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T16:59:49.718Z","modified":"2026-10-28T10:40:57.717161227Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green","level":"medium"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2024-11407","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T17:15:22.83Z","modified":"2026-11-02T12:00:24.016605494Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-2573","title":"grpc security update","description":"gRPC is a modern open source high performance RPC framework that can run in any environment. It can efficiently connect services in and across data centers with pluggable support for load balancing, tracing, health checking and authentication. It is also applicable in last mile of distributed computing to connect devices, mobile applications and browsers to backend services.\r\n\r\nSecurity Fix(es):\r\n\r\nThere exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791(CVE-2024-11407)","status":"published","published":"2024-12-20T11:08:03Z","modified":"2026-08-18T01:17:43.895466021Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2025:0340","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2025-01-16T10:02:24Z","modified":"2026-10-16T10:05:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:1019","title":"Red Hat Security Advisory: Satellite 6.16.2 Async Update","status":"published","published":"2025-02-07T10:19:59Z","modified":"2026-10-14T10:06:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2024-11407","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T17:15:00Z","modified":"2026-10-17T12:56:28.685454082Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"AZL-53456","title":"CVE-2024-11407 affecting package grpc for versions less than 1.62.0-4","description":"There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","status":"published","published":"2024-11-26T17:15:22Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"openSUSE-SU-2025:15031-1","title":"python311-grpcio-1.69.0-2.1 on GA media","description":"These are all security issues fixed in the python311-grpcio-1.69.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-25T00:00:00Z","modified":"2026-02-04T03:07:30.152138Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2024:4393-1","title":"Security update for python-grpcio","description":"This update for python-grpcio fixes the following issues:\n\n- CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)\n- CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)\n","status":"published","published":"2024-12-20T10:24:03Z","modified":"2026-02-04T04:24:49.960892Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4400-1","title":"Security update for grpc","description":"This update for grpc fixes the following issues:\n\n- CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)\n- CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)\n","status":"published","published":"2024-12-20T15:27:37Z","modified":"2026-02-04T04:08:19.37885Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4401-1","title":"Security update for grpc","description":"This update for grpc fixes the following issues:\n\n- CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)\n- CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)\n","status":"published","published":"2024-12-20T15:27:57Z","modified":"2026-02-04T02:43:54.716492Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4428-1","title":"Security update for python-grpcio","description":"This update for python-grpcio fixes the following issues:\n\n- CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)\n- CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)\n","status":"published","published":"2024-12-27T10:16:23Z","modified":"2026-02-04T03:36:09.766597Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4429-1","title":"Security update for python-grpcio","description":"This update for python-grpcio fixes the following issues:\n\n- CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)\n- CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)\n","status":"published","published":"2024-12-27T10:16:39Z","modified":"2026-02-04T02:30:06.469379Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4436-1","title":"Security update for grpc","description":"This update for grpc fixes the following issues:\n\n- CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)\n- CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)\n","status":"published","published":"2024-12-30T13:23:16Z","modified":"2026-02-04T04:24:18.131347Z","updated_at":"2026-11-02T15:53:56.123059Z"}]}}