p PatchFirst

CVE-2023-4785

CVE-2023-4785 · Denial of Service in gRPC Core

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

CVSS 7.5 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • grpc

    Versions
    • ≥ 0, < 1.23: Not affected (custom)
    • 1.57: Not affected
    • ≥ 1.56.0, ≤ 1.56.1: Affected; ≥ 1.56.2: Not affected (custom)
    • ≥ 1.55.0, ≤ 1.55.2: Affected; ≥ 1.55.3: Not affected (custom)
    • ≥ 1.54.0, ≤ 1.54.2: Affected; ≥ 1.54.3: Not affected (custom)
    • ≥ 1.53.0, ≤ 1.53.1: Affected; ≥ 1.53.2: Not affected (custom)

    Update to 1.53.2; Update to 1.54.3; Update to 1.55.3; Update to 1.56.2

  • grpc Debian:12

    Versions
    • 1.51.1-10
    • 1.51.1-3
    • 1.51.1-4
    • 1.51.1-4.1
    • 1.51.1-4.1~exp1
    • 1.51.1-5
    • 1.51.1-6
    • 1.51.1-7
    • 1.51.1-8
    • 1.51.1-9
    • 1.59.5-1
    • 1.82.0-1
    • 1.83.0-1
    • 1.83.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Debian:13

    Versions
    • 1.51.1-10
    • 1.51.1-6
    • 1.51.1-7
    • 1.51.1-8
    • 1.51.1-9
    • 1.59.5-1
    • 1.82.0-1
    • 1.83.0-1
    • 1.83.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Debian:14

    Versions
    • 1.51.1-10
    • 1.51.1-6
    • 1.51.1-7
    • 1.51.1-8
    • 1.51.1-9
    • 1.59.5-1
    • 1.82.0-1
    • 1.83.0-1
    • 1.83.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc RubyGems

    Versions
    • 1.56.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.56.0, < 1.56.2

    Update to 1.56.2

  • grpc RubyGems

    Versions
    • 1.55.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.55.0, < 1.55.3

    Update to 1.55.3

  • grpc RubyGems

    Versions
    • 1.54.0
    • 1.54.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.54.0, < 1.54.3

    Update to 1.54.3

  • grpc RubyGems

    Versions
    • 1.53.0
    • 1.53.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.53.0, < 1.53.2

    Update to 1.53.2

  • grpcio PyPI

    Versions
    • 1.55.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.55.0, < 1.55.3

    Update to 1.55.3

  • grpcio PyPI

    Versions
    • 1.54.0
    • 1.54.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.54.0, < 1.54.3

    Update to 1.54.3

  • grpcio PyPI

    Versions
    • 1.53.0
    • 1.53.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.53.0, < 1.53.2

    Update to 1.53.2

  • grpcio PyPI

    Versions
    • 1.53.0
    • 1.53.1
    • 1.54.0
    • 1.54.2
    • 1.55.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.55.0, < 1.55.3 ∪ ≥ 1.54.0, < 1.54.3 ∪ ≥ 1.53.0, < 1.53.2

    Update to 1.55.3; Update to 1.54.3; Update to 1.53.2

  • grpc Ubuntu:16.04:LTS

    Versions
    • 0.10.2-1
    • 0.11.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:18.04:LTS

    Versions
    • 1.3.2-1
    • 1.3.2-1ubuntu1
    • 1.3.2-1.1~build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:20.04:LTS

    Versions
    • 1.16.1-1
    • 1.16.1-1ubuntu1
    • 1.16.1-1ubuntu3
    • 1.16.1-1ubuntu4
    • 1.16.1-1ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:22.04:LTS

    Versions
    • 1.30.2-3
    • 1.30.2-3build1
    • 1.30.2-3build3
    • 1.30.2-3build5
    • 1.30.2-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:24.04:LTS

    Versions
    • 1.51.1-3build3
    • 1.51.1-3build4
    • 1.51.1-4
    • 1.51.1-4build1
    • 1.51.1-4build2
    • 1.51.1-4.1build3
    • 1.51.1-4.1build4
    • 1.51.1-4.1build5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:25.10

    Versions
    • 1.51.1-6
    • 1.51.1-6build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:26.10

    Versions
    • 1.51.1-8ubuntu1
    • 1.51.1-9
    • 1.51.1-9ubuntu3
    • 1.51.1-10ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:26.04:LTS

    Versions
    • 1.51.1-6build1
    • 1.51.1-7
    • 1.51.1-7ubuntu2
    • 1.51.1-7ubuntu3
    • 1.51.1-8ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →