CVE-2024-47609: hyperium tonic
Vulnerability summary
CVE-2024-47609 is a medium (CVSS 6.9) vulnerability in hyperium tonic. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 01-10-2024PublishedVulnerability first disclosed.
- 21-11-2024Last modifiedVulnerability information updated.
Description
Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green
- OSV · Crates.ioEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- atuin< 18.4.0-r1
- buck2< 20250301-r0
- parseable< 1.7.5-r0
- qdrant< 1.13.5-r0
- qdrant-oci-compat< 1.13.5-r0
Wolfi8 products
- atuin< 18.4.0-r1
- buck2< 20250301-r0
- parseable< 1.7.5-r0
- qdrant< 1.13.5-r0
- qdrant-oci-compat< 1.13.5-r0
Crates.Io1 product
- tonic≥ 0.12.2, < 0.12.3
Hyperium1 product
- tonic≥ 0.12.2, < 0.12.3
Opensuse1 product
- cargo-audit-advisory-db&distro=openSUSE Tumbleweed< 20241030-1.1
Ubuntu1 product
- rust-tonicAll versions (No fix recorded)
6 vendors · 20 products
References
12 links- github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qvX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/hyperium/tonic/commit/a4472a86f3290e60c7c01348b7e6a8164d6e7e48X Refsource MISCREPORTFIXWEB
- lists.opensuse.org/archives/…Advisory
Show all 12 references
- github.com/hyperium/tonicPACKAGE
- crates.io/crates/tonicPACKAGE