p PatchFirst

CVE-2023-1428

CVE-2023-1428 · Denial-of-Service in gRPC

This page contains facts from public vulnerability sources. Check the original advisory before updating.

There exists an vulnerability causing an abort() to be called in gRPC.  The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.

CVSS 7.5 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • grpc

    Versions
    • ≥ 1.51, < 1.53: Affected (custom)

    Update to 1.53

  • io.grpc:grpc-protobuf Maven

    Versions
    • 1.51.0
    • 1.51.1
    • 1.51.3
    • 1.52.0
    • 1.52.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.51.0, < 1.53.0

    Update to 1.53.0

  • grpcio PyPI

    Versions
    • 1.51.0
    • 1.51.1
    • 1.51.3
    • 1.52.0
    • 1.52.0rc1
    • 1.53.0rc2
    Affected ranges
    • ECOSYSTEM: ≥ 1.51.0, < 1.53.0

    Update to 1.53.0

  • grpc RubyGems

    Versions
    • 1.51.0
    • 1.52.0
    • 1.52.0.pre2
    • 1.52.2
    • 1.53.0.pre2
    Affected ranges
    • ECOSYSTEM: ≥ 1.51.0, < 1.53.0

    Update to 1.53.0

  • grpc Ubuntu:16.04:LTS

    Versions
    • 0.10.2-1
    • 0.11.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:18.04:LTS

    Versions
    • 1.3.2-1
    • 1.3.2-1ubuntu1
    • 1.3.2-1.1~build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:20.04:LTS

    Versions
    • 1.16.1-1
    • 1.16.1-1ubuntu1
    • 1.16.1-1ubuntu3
    • 1.16.1-1ubuntu4
    • 1.16.1-1ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:22.04:LTS

    Versions
    • 1.30.2-3
    • 1.30.2-3build1
    • 1.30.2-3build3
    • 1.30.2-3build5
    • 1.30.2-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:24.04:LTS

    Versions
    • 1.51.1-3build3
    • 1.51.1-3build4
    • 1.51.1-4
    • 1.51.1-4build1
    • 1.51.1-4build2
    • 1.51.1-4.1build3
    • 1.51.1-4.1build4
    • 1.51.1-4.1build5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:25.10

    Versions
    • 1.51.1-6
    • 1.51.1-6build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:26.10

    Versions
    • 1.51.1-8ubuntu1
    • 1.51.1-9
    • 1.51.1-9ubuntu3
    • 1.51.1-10ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:26.04:LTS

    Versions
    • 1.51.1-6build1
    • 1.51.1-7
    • 1.51.1-7ubuntu2
    • 1.51.1-7ubuntu3
    • 1.51.1-8ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →