How severe is CVE-2024-7246?

CVE-2024-7246 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-7246 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-7246?

CVE-2024-7246 affects Grpc. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-7246?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-7246 have an EU (EUVD) identifier?

Yes. CVE-2024-7246 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48194.

When was CVE-2024-7246 published?

CVE-2024-7246 was published on 2024-08-06 and last updated on 2026-06-17.

CVE-2024-7246

CVE-2024-7246 is a medium-severity vulnerability in Grpc with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-440.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 6.3
EPSS exploit prediction: 0% (13th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-48194
Weakness: CWE-440
Affected product: Grpc
Published: 2024-08-06
Last modified: 2026-06-17

Description

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.

Frequently asked questions

What is CVE-2024-7246?: It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
How severe is CVE-2024-7246?: CVE-2024-7246 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-7246 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-7246?: CVE-2024-7246 affects Grpc. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-7246?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-7246 have an EU (EUVD) identifier?: Yes. CVE-2024-7246 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48194.
When was CVE-2024-7246 published?: CVE-2024-7246 was published on 2024-08-06 and last updated on 2026-06-17.

References

https://github.com/grpc/grpc/issues/36245

Affected products (1)

cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*

More vulnerabilities in Grpc

CVE-2017-9431 — Critical (CVSS 9.8): Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to…
CVE-2017-8359 — Critical (CVSS 9.8): Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the…
CVE-2017-7861 — Critical (CVSS 9.8): Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.
CVE-2017-7860 — Critical (CVSS 9.8): Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the…
CVE-2026-33186 — Critical (CVSS 9.1): gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from…
CVE-2024-11407 — High (CVSS 7.5): There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy…

All CVEs affecting Grpc →

Other CWE-440 vulnerabilities

CVE-2019-6569 — Critical (CVSS 9.1): The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into…
CVE-2024-32971 — Critical (CVSS 9.0): Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation…
CVE-2025-8850 — High (CVSS 8.8): In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA)…
CVE-2026-8806 — High (CVSS 8.7): Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module…
CVE-2018-12550 — High (CVSS 8.1): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty,…
CVE-2023-4807 — High (CVSS 7.8): Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the…

Browse all CWE-440 vulnerabilities →