Finished streaming calls keep reading a stalled request body indefinitely

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Affected versions of `connectrpc` start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request stream, an interceptor can reject the call, or the request timeout can fire. The background task then keeps reading, with no time limit. If the client stops sending part-way through a message, or never sends the rest, the task, the partial message it has buffered (up to `max_message_size`, 4 MiB by default) and the HTTP/2 stream, or the HTTP/1.x connection, are held until the client finishes the stream or closes the connection. ## Impact A client can use this to exhaust the memory, tasks and file descriptors of a server. With the default limits of the built-in `Server`, one HTTP/2 connection can hold 200 stalled streams, about 800 MiB at the default message size, and the server does not limit the number of connections. A server that authenticates in Tower middleware, before the request reaches the service, is exposed only to callers with a valid credential. A server with no authentication, or one that authenticates in an interceptor, is exposed to any client. This advisory covers client-streaming and bidirectional-streaming calls only. ## Patches Versions 0.8.2 and 0.9.1 bound the wait. When the handler is gone, the reader frees the partial message and discards the rest of the body for at most 5 seconds and 1 MiB, then drops it, which resets the HTTP/2 stream or closes the HTTP/1.x connection. On `wasm32`, which has no clock, only the 1 MiB limit applies. Versions 0.2.0 to 0.7.0 contain the same reader and are not patched; upgrade to 0.8.2 or later. ## Workarounds Authenticate in Tower middleware rather than in an interceptor, so a request without a credential is rejected before any reader starts. Set `Server::with_max_connection_age`, which closes each connection, and every stalled body on it, once its age and the grace period have passed. Lowering `Limits::with_max_message_size` and `Server::with_max_concurrent_streams` reduces what one client can hold but does not release a stalled body.

Source published

21 Sep 2026 12:00:00 UTC

Source modified

23 Sep 2026 07:45:03 UTC

Saved here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N