CVE-2023-1428
Denial-of-Service in gRPC
Reported by google · Published June 9, 2023
grpcio is fixed in 1.53.0 (PyPI)
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| grpcio | PyPI | 1.53.0 |
| grpc | RubyGems | 1.53.0 |
| io.grpc:grpc-protobuf | Maven Central | 1.53.0 |
| hive | Chainguard | 4.0.1-r1 |
| wavefront-proxy | Chainguard | 13.4-r1 |
| stargate | Chainguard | 1.0.78-r2 |
| wavefront-proxy | Wolfi | 13.4-r1 |
| gRPC | 1.53 | |
| grpc | grpc | 1.53.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| gRPC | 1.51 | |
| gRPC | 1.51 | |
| grpc | grpc | 1.51.0 |
Timeline
- Jun 9, 2023 CVE Published
- Jun 9, 2023 PoC Published
- Jun 10, 2023 EPSS Score (30 in total, the first dated here)
- Mar 9, 2026 Security Advisory
- May 21, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-1428
vulnetix vdb fixes CVE-2023-1428Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-1428/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart