CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2023-4785
High (7.5) in grpc grpc. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in grpc 1.53.2, 1.54.3, 1.55.3.
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-248
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grpc:grpc
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p25m-jpj4-qcrr | RubyGems | grpc | >=1.56.0 <1.56.2 | 1.56.2 |
| GHSA-p25m-jpj4-qcrr | RubyGems | grpc | >=1.55.0 <1.55.3 | 1.55.3 |
| GHSA-p25m-jpj4-qcrr | RubyGems | grpc | >=1.54.0 <1.54.3 | 1.54.3 |
| GHSA-p25m-jpj4-qcrr | RubyGems | grpc | >=1.53.0 <1.53.2 | 1.53.2 |
| GHSA-p25m-jpj4-qcrr | PyPI | grpcio | >=1.55.0 <1.55.3 | 1.55.3 |
| GHSA-p25m-jpj4-qcrr | PyPI | grpcio | >=1.54.0 <1.54.3 | 1.54.3 |
| GHSA-p25m-jpj4-qcrr | PyPI | grpcio | >=1.53.0 <1.53.2 | 1.53.2 |
| PYSEC-2026-1428 | PyPI | grpcio | >=1.55.0 <1.55.3 >=1.54.0 <1.54.3 >=1.53.0 <1.53.2 | 1.55.3, 1.54.3, 1.53.2 |