Skip to main content

Incomplete Internal State Distinction


Severity High
Score 7.5/10


Mismanaged state in "GRPCWebToHTTP2ServerCodec.swift" in gRPC Swift versions 1.0.0-alpha.21 prior to 1.2.0 leads to Denial of Service if remote attackers send malformed requests.

  • LOW
  • NONE
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-372 - Incomplete Internal State Distinction

The software does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

Advisory Timeline

  • Published