GitHub Advisoryadvisory · Maven, PyPI, RubyGems

GHSA-9hxf-ppjv-w6rq gRPC connection termination issue

MEDIUM Published 2023-07-06 Modified 2025-08-13 Official page ↗
Aliases
CVE-2023-32732
Ecosystem
Maven, PyPI, RubyGems
Packages
io.grpc:grpc-protobuf, grpcio, grpc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-440
Reviewed
2023-07-06

Affected packages

• Maven io.grpc:grpc-protobuf: >= 1.53.0, < 1.53.1 → fixed in 1.53.1 • PyPI grpcio: >= 1.53.0, < 1.53.1 → fixed in 1.53.1 • RubyGems grpc: >= 1.53.0, < 1.53.1 → fixed in 1.53.1 • Maven io.grpc:grpc-protobuf: >= 1.54.0, < 1.54.2 → fixed in 1.54.2 • PyPI grpcio: >= 1.54.0, < 1.54.2 → fixed in 1.54.2 • RubyGems grpc: >= 1.54.0, < 1.54.2 → fixed in 1.54.2

Description

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.

Related

Alias · CVE (1)

  • CVE-2023-32732 gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64… vulnerability

Weakness · CWE (1)

  • CWE-440 Expected Behavior Violation weakness

References