Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade grpc | Jan 10, 2024 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade grpc | Jan 10, 2024 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade grpc | Jul 23, 2024 | Sep 13, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade grpc | Jan 10, 2024 | Sep 13, 2023 |
| Suse | — | Upgrade libre2-11Upgrade libgrpc37Upgrade libprotobuf-lite25_1_0-32bitUpgrade python311-protobufUpgrade libupb37Upgrade python311-grpcioUpgrade libprotobuf25_1_0Upgrade libprotobuf25_1_0-32bitUpgrade grpc-develUpgrade re2-develUpgrade opencensus-proto-sourceUpgrade abseil-cpp-develUpgrade libabsl2308_0_0Upgrade libabsl2308_0_0-32bitUpgrade grpc-sourceUpgrade protobuf-javaUpgrade python311-abseilUpgrade upb-develUpgrade libprotoc25_1_0Upgrade libgrpc++1_60Upgrade libgrpc1_60Upgrade libprotoc25_1_0-32bitUpgrade libre2-11-32bitUpgrade protobuf-develUpgrade libprotobuf-lite25_1_0 | Feb 22, 2024 | Sep 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub