Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade grpc | Jan 10, 2024 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade grpc | Jan 10, 2024 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade grpc | Jul 23, 2024 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade grpc | Jan 10, 2024 | Sep 13, 2023 |
| Suse | — | Upgrade python311-protobufUpgrade opencensus-proto-sourceUpgrade libprotobuf-lite25_1_0-32bitUpgrade abseil-cpp-develUpgrade libgrpc37Upgrade libre2-11Upgrade libupb37Upgrade grpc-develUpgrade python311-grpcioUpgrade re2-develUpgrade libprotobuf25_1_0Upgrade libprotobuf25_1_0-32bitUpgrade python311-abseilUpgrade libprotoc25_1_0-32bitUpgrade libgrpc1_60Upgrade libre2-11-32bitUpgrade upb-develUpgrade libgrpc++1_60Upgrade protobuf-javaUpgrade libabsl2308_0_0-32bitUpgrade libabsl2308_0_0Upgrade libprotobuf-lite25_1_0Upgrade protobuf-develUpgrade libprotoc25_1_0Upgrade grpc-source | Feb 22, 2024 | Sep 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub