Manqingzhou

**Name of the Vulnerable Software and Affected Versions** @grpc/grpc-js versions prior to 1.13.1 @grpc/grpc-js versions prior to 1.14.1 **Description** When case-insensitive matching is enabled, the Role-Based Access Control (RBAC) exact path matcher performs a prefix comparison instead of an equality comparison for method names. If one service method name is a prefix of another and both have different access rules, a request for the longer method may incorrectly match the rule of the shorter method, leading to improper authorization. **Recommendations** Update to version 1.13.1. Update to version 1.14.1. Enable case-sensitive path matching to avoid this issue.

**Name of the Vulnerable Software and Affected Versions** @grpc/grpc-js versions prior to 1.13.6 @grpc/grpc-js versions prior to 1.14.5 **Description** When an application method handler throws an uncaught error, the server includes the error message in the status message sent to the client. This can lead to sensitive information disclosure if the error message contains confidential data. **Recommendations** Update @grpc/grpc-js to version 1.13.6. Update @grpc/grpc-js to version 1.14.5.

**Name of the Vulnerable Software and Affected Versions** @grpc/grpc-js versions prior to 1.13.6 @grpc/grpc-js versions prior to 1.14.5 **Description** The `getAuthContext()` function fails to distinguish between authorized and unauthorized peer certificates when server credentials have `requireClientCertificate` set to false. This can lead to improper authentication if applications rely on the returned authentication context, treating unauthorized certificates as authorized. This condition can also occur in @grpc/grpc-js-xds when Role-Based Access Control (RBAC) authentication is enabled in affected configurations. **Recommendations** Update @grpc/grpc-js to version 1.13.6. Update @grpc/grpc-js to version 1.14.5.

**Name of the Vulnerable Software and Affected Versions** jackson-core versions 2.8.0 through 2.17.0 **Description** The `UTF8DataInputJsonParser. reportInvalidToken()` function in FasterXML jackson-core fails to limit the length of the offending-token text when building an error message. When a malformed token is supplied to a parser created via `JsonFactory.createParser(DataInput)`, the parser appends characters to a `StringBuilder` in a loop without an upper bound, ignoring the `ErrorReportConfiguration.getMaxErrorTokenLength()` setting. This process bypasses `ReadConstrainedTextBuffer`, meaning `maxStringLength` and `maxDocumentLength` constraints do not mitigate the issue. A large malformed token can cause the `StringBuilder` to expand significantly due to byte-to-char expansion and internal array doubling, potentially triggering an `OutOfMemoryError` for the entire JVM. **Recommendations** Update to a version where the `UTF8DataInputJsonParser. reportInvalidToken()` function is patched to respect token length limits. As a temporary workaround, avoid using `JsonFactory.createParser(DataInput)` when processing untrusted input.

**Name of the Vulnerable Software and Affected Versions** jackson-core versions 2.17.0 through 2.17.2 **Description** The `looksLikeValidNumber()` function in `NumberInput` uses regular expressions to pre-validate stringified numbers. The `PATTERN FLOAT` regex contains adjacent quantifiers over the same character class, which causes Java's backtracking engine to retry every possible split point when an input fails to match. This results in the matching cost growing quadratically relative to the input length. An attacker can trigger this behavior by providing JSON that the application deserializes into numeric types such as `BigDecimal`, `BigInteger`, `Double`, or `Float` via default String-to-number coercion. Since the `maxStringLength` in `StreamReadConstraints` defaults to 20,000,000 characters, large inputs can be processed, potentially exhausting the server's request-handling thread pool with a small number of concurrent requests. **Recommendations** Update jackson-core to a version later than 2.17.2.