-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grpc/grpc-swift | swift | < 1.7.2 | 1.7.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from incorrect state handling when receiving GOAWAY frames followed by new streams. The commit diff shows removal of two critical preconditions in the quiescing state handler: 'precondition(state.initiatedByUs)' and 'precondition(state.role == .client)'. These assertions were reachable when a server received a GOAWAY frame and then a new stream, violating the assumptions about client-initiated shutdown. The assertions would trigger crashes via Swift.preconditionFailure(), enabling DoS through malicious frame sequences.