Memory Exhaustion Vulnerability in connectrpc: Indefinite Reading of Stalled Request Bodies
Summary
RUSTSEC-2026-0304: Finished streaming calls keep reading a stalled request body indefinitely. Affects connectrpc across 2 version ranges.
>= 0.2.0, < 0.8.2
>= 0.9.0, < 0.9.1
Fixed in 0.8.2 or 0.9.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
connectrpc is a Rust library designed for building gRPC services with a focus on simplicity and performance. It facilitates client-streaming and bidirectional-streaming calls, allowing for efficient communication between clients and servers. However, certain versions of connectrpc have a vulnerability that can lead to memory exhaustion, impacting server stability and performance.
Vulnerability Detail
The vulnerability arises from the way connectrpc handles client-streaming and bidirectional-streaming calls. A background task is initiated to read the request body before the interceptors or handler execute. If a call completes without consuming its entire request, the background task continues to read indefinitely, potentially holding onto memory, tasks, and file descriptors. This can lead to a denial-of-service condition, as a single HTTP/2 connection can maintain multiple stalled streams, consuming significant server resources. The issue is particularly critical for servers without proper authentication, exposing them to potential abuse by malicious clients.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.2.0, < 0.8.20.8.2 -
>= 0.9.0, < 0.9.10.9.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can authenticate requests in Tower middleware instead of in an interceptor. This ensures that any request without valid credentials is rejected before any reading begins. Additionally, you can set the maximum connection age using the following code:
let server = Server::with_max_connection_age(Duration::from_secs(30));
Conclusion
In summary, the connectrpc library has a vulnerability that allows for indefinite reading of stalled request bodies, which can lead to memory exhaustion on the server. Upgrading to version 0.8.2 or later is essential to mitigate this issue. Implementing authentication in middleware and adjusting server configurations can also help reduce the risk.
See every vulnerability recorded for connectrpc →
FAQ
Versions 0.2.0 to 0.7.0 of connectrpc are affected. It is recommended to upgrade to version 0.8.2 or later.
The vulnerability can lead to memory exhaustion on the server, allowing a malicious client to hold multiple stalled streams, which can crash or degrade the server's performance.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application's Cargo.lock for vulnerabilities without needing to sign up.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
Yes, you can lower the maximum message size and the maximum concurrent streams on the server to limit the resources a single client can consume.
