GHSA-87m9-rv8p-rgmg: go-grpc-compression has a zstd decompression bombing vulnerability
7.5
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mostynb/go-grpc-compression | go | >= 1.1.4, < 1.2.3 | 1.2.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description explicitly mentions that the Decoder.DecodeAll function from github.com/klauspost/compress/zstd was the source of the vulnerability. The provided commit patch shows that the Decompress method within the compressor struct in internal/zstd/zstd.go was modified to remove the usage of c.decoder.DecodeAll. This directly addresses the vulnerability. The function compressor.Decompress was responsible for calling the vulnerable DecodeAll function, making it the key function involved in the vulnerability. The confidence is high because the patch directly modifies this function to remove the vulnerable call, and the commit message and vulnerability description corroborate this finding. The function signature compressor.Decompress is precise as it would appear in a Go profiler, including the receiver type.