{"id":"CVE-2023-32732","published":"2023-06-09T10:48:15Z","modified":"2025-02-13T16:55:01Z","title":"Denial-of-Service in gRPC","vendor":"Google","product":"gRPC","tier":"tail","description":{"text":"gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in  https://github.com/grpc/grpc/pull/32309 https://www.google.com/url","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00527,"percentile":0.44641,"provenance":"source"},"cwes":[{"id":"CWE-440","name":"Expected Behavior Violation"}],"references":[{"url":"https://github.com/grpc/grpc/pull/32309","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37IDNVY5AWVH7JDMM2SDTL24ZPPZJNSY/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VWE44J5FG7THHL7XVEVTNIGEYBNKJBLL/","tags":[]}],"priority":{"score":12.6,"factors":[{"name":"EPSS percentile","points":8.93},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"google","affectedVersions":[{"vendor":"Google","product":"gRPC","versions":[">= 1.53, < 1.54"]}],"affected":[{"ecosystem":"Maven","package":"io.grpc:grpc-protobuf","vulnerableRanges":[">=1.53.0, <1.53.1",">=1.54.0, <1.54.2"],"patched":["1.53.1","1.54.2"],"from":["GHSA-9hxf-ppjv-w6rq"],"provenance":"source"},{"ecosystem":"PyPI","package":"grpcio","vulnerableRanges":[">=1.53.0, <1.53.1",">=1.54.0, <1.54.2"],"patched":["1.53.1","1.54.2"],"from":["GHSA-9hxf-ppjv-w6rq","PYSEC-2026-1426"],"provenance":"source"},{"ecosystem":"RubyGems","package":"grpc","vulnerableRanges":[">=1.53.0, <1.53.1",">=1.54.0, <1.54.2"],"patched":["1.53.1","1.54.2"],"from":["GHSA-9hxf-ppjv-w6rq"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2014","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-8359","published":"2017-04-30","fixed":"1.3.0","kev":false},{"cve":"CVE-2023-1428","published":"2023-06-09","fixed":"1.53.0","kev":false,"link":{"from":"CVE-2023-1428","to":"CVE-2023-32732","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:grpcio","fromFixed":"1.53.0","toFixed":"1.53.1","daysApart":0},{"kind":"version-step","provenance":"source","package":"RubyGems:grpc","fromFixed":"1.53.0","toFixed":"1.53.1","daysApart":0}]}},{"cve":"CVE-2023-32731","published":"2023-06-09","fixed":"1.54.2","kev":false},{"cve":"CVE-2023-32732","published":"2023-06-09","fixed":"1.54.2","kev":false},{"cve":"CVE-2023-4785","published":"2023-09-13","fixed":"1.55.3","kev":false},{"cve":"CVE-2023-33953","published":"2023-08-09","fixed":"1.56.2","kev":false}],"package":"PyPI:grpcio"}}