CVE-2023-32731
CVE-2023-32731 is a high-severity vulnerability in Grpc with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-440.
Key facts
- Severity: High (CVSS 3.x base score 7.4)
- EPSS exploit prediction: 1% (39th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-440
- Affected product: Grpc
- Published:
- Last modified:
Description
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005
Frequently asked questions
- What is CVE-2023-32731?
- When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005
- How severe is CVE-2023-32731?
- CVE-2023-32731 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
- Is CVE-2023-32731 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-32731?
- CVE-2023-32731 affects Grpc. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-32731?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2023-32731 published?
- CVE-2023-32731 was published on 2023-06-09 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*
More vulnerabilities in Grpc
- CVE-2017-9431 — Critical (CVSS 9.8): Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to…
- CVE-2017-8359 — Critical (CVSS 9.8): Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the…
- CVE-2017-7861 — Critical (CVSS 9.8): Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.
- CVE-2017-7860 — Critical (CVSS 9.8): Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the…
- CVE-2026-33186 — Critical (CVSS 9.1): gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from…
- CVE-2024-11407 — High (CVSS 7.5): There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy…
Other CWE-440 vulnerabilities
- CVE-2019-6569 — Critical (CVSS 9.1): The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into…
- CVE-2024-32971 — Critical (CVSS 9.0): Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation…
- CVE-2025-8850 — High (CVSS 8.8): In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA)…
- CVE-2026-8806 — High (CVSS 8.7): Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module…
- CVE-2018-12550 — High (CVSS 8.1): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty,…
- CVE-2023-4807 — High (CVSS 7.8): Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the…