CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2023-32731
High (7.5) in grpc grpc. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in io.grpc:grpc-protobuf 1.53.1, 1.54.2.
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWE
- CWE-440
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grpc:grpc
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cfgp-2977-2fmm | Maven | io.grpc:grpc-protobuf | >=1.53.0 <1.53.1 | 1.53.1 |
| GHSA-cfgp-2977-2fmm | PyPI | grpcio | >=1.53.0 <1.53.1 | 1.53.1 |
| GHSA-cfgp-2977-2fmm | RubyGems | grpc | >=1.53.0 <1.53.1 | 1.53.1 |
| GHSA-cfgp-2977-2fmm | PyPI | grpcio | >=1.54.0 <1.54.2 | 1.54.2 |
| GHSA-cfgp-2977-2fmm | RubyGems | grpc | >=1.54.0 <1.54.2 | 1.54.2 |
| GHSA-cfgp-2977-2fmm | Maven | io.grpc:grpc-protobuf | >=1.54.0 <1.54.2 | 1.54.2 |
| PYSEC-2026-1427 | PyPI | grpcio | >=1.53.0 <1.53.1 >=1.54.0 <1.54.2 | 1.53.1, 1.54.2 |