GHSA-9hxf-ppjv-w6rq

Source

https://github.com/advisories/GHSA-9hxf-ppjv-w6rq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-9hxf-ppjv-w6rq/GHSA-9hxf-ppjv-w6rq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9hxf-ppjv-w6rq

Aliases

CVE-2023-32732

Related

Published

2023-07-06T21:15:08Z

Modified

2025-08-13T15:19:18.762892Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

gRPC connection termination issue

Details

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.

Database specific

{
    "cwe_ids": [
        "CWE-440"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T23:56:31Z",
    "nvd_published_at": "2023-06-09T11:15:09Z"
}

References

Affected packages

Maven / io.grpc:grpc-protobuf

Package

Name: io.grpc:grpc-protobuf; View open source insights on deps.dev
Purl: pkg:maven/io.grpc/grpc-protobuf

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.53.0

Fixed

1.53.1

Affected versions

1.*

1.53.0

PyPI / grpcio

Package

Name: grpcio; View open source insights on deps.dev
Purl: pkg:pypi/grpcio

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.53.0

Fixed

1.53.1

Affected versions

1.*

1.53.0

RubyGems / grpc

Package

Name: grpc
Purl: pkg:gem/grpc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.53.0

Fixed

1.53.1

Affected versions

1.*

1.53.0

Maven / io.grpc:grpc-protobuf

Package

Name: io.grpc:grpc-protobuf; View open source insights on deps.dev
Purl: pkg:maven/io.grpc/grpc-protobuf

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.54.0

Fixed

1.54.2

Affected versions

1.*

1.54.0

1.54.1

PyPI / grpcio

Package

Name: grpcio; View open source insights on deps.dev
Purl: pkg:pypi/grpcio

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.54.0

Fixed

1.54.2

Affected versions

1.*

1.54.0

RubyGems / grpc

Package

Name: grpc
Purl: pkg:gem/grpc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.54.0

Fixed

1.54.2

Affected versions

1.*

1.54.0