VDB

GHSA-87m9-rv8p-rgmg

GHSA-87m9-rv8p-rgmg PUBLISHED CVSS 7.5 HIGH

go-grpc-compression has a zstd decompression bombing vulnerability

Record from GitHub Advisory Database · Published June 10, 2024

github.com/mostynb/go-grpc-compression is fixed in 1.2.3 (Go Modules)

go-grpc-compression has a zstd decompression bombing vulnerability

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/mostynb/go-grpc-compressionGo Modules1.2.3
tempo-2.3Chainguard2.3.1-r4
spicedbChainguard1.33.0-r2
tempoChainguard2.5.0-r3
opentelemetry-collectorWolfi0.139.0-r0
tempoWolfi2.5.0-r3
datadog-agent-fipsChainguard7.54.0-r4
opentelemetry-collector-contribChainguard0.102.0-r3
tempo-fipsChainguard2.5.0-r4
spicedbWolfi1.33.0-r2
opentelemetry-collector-contrib-fipsChainguard0.102.0-r1
datadog-agentWolfi7.54.0-r4

4 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
chainguardtempo-2.30
chainguardspicedb0
Gogithub.com/mostynb/go-grpc-compression1.1.4
chainguardtempo0
wolfiopentelemetry-collector0
wolfitempo0
github.commostynb/go-grpc-compression1.1.4
chainguarddatadog-agent-fips0
chainguardopentelemetry-collector-contrib0
chainguardtempo-fips0
wolfispicedb0
chainguardopentelemetry-collector-contrib-fips0
github.commostynb/go-grpc-compression1.1.4
wolfidatadog-agent0
chainguardopentelemetry-collector0
chainguardopentelemetry-collector-fips0
wolfiopentelemetry-collector-contrib0
chainguarddatadog-agent0

Timeline

  • Jun 10, 2024 CVE Published
  • Feb 4, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-87m9-rv8p-rgmg
vulnetix vdb fixes GHSA-87m9-rv8p-rgmg

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-87m9-rv8p-rgmg/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›