GHSA-6628-q6j9-w8vg CVE-2023-1428 PYSEC-2026-1425
gRPC Reachable Assertion issue
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.41%
- Chance of exploitation in the next 30 days. Higher than 34.87% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-617 Reachable Assertion
- Fix
- Available
- 3 packages have a fixed version
Description
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:
te: x (x != trailers)
:scheme: x (x != http, https)
grpclb_client_stats: x (x == anything)
On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| io.grpc:grpc-protobuf | >= 1.51.0, < 1.53.0 |
1.53.0 |
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| grpcio | >= 1.51.0, < 1.53.0 |
1.53.0 |
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| grpc | >= 1.51.0, < 1.53.0 |
1.53.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
io.grpc:grpc-protobuf Maven → 1.53.0
- maven
<dependency><groupId>io.grpc</groupId><artifactId>grpc-protobuf</artifactId><version>1.53.0</version></dependency>- gradle
implementation("io.grpc:grpc-protobuf:1.53.0")
grpcio PyPI → 1.53.0
- pip
pip install --upgrade "grpcio>=1.53.0"- poetry
poetry add "grpcio>=1.53.0"- uv
uv add "grpcio>=1.53.0"
grpc RubyGems → 1.53.0
- bundler
bundle update grpc # Gemfile: gem "grpc", ">= 1.53.0"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-617: Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
How to prevent it
- Implementation: Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
- Implementation: Perform input validation on user data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p25m-jpj4-qcrr Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms) | High | Also affects grpc |
| GHSA-496j-2rq6-j6cc Excessive Iteration in gRPC | High | Also affects grpc |
| GHSA-9hxf-ppjv-w6rq gRPC connection termination issue | Medium | Also affects grpc |
| GHSA-cfgp-2977-2fmm Connection confusion in gRPC | High | Also affects grpc |
| GHSA-gq5q-89c7-vhvx vLLM DeepSeek-OCR image processing vulnerable to denial of service | Medium | Same weakness, CWE-617 |
| GHSA-qrxm-fqhp-jwvm undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation | High | Same weakness, CWE-617 |
| GHSA-ph72-cqr5-qpp7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features | Medium | Same weakness, CWE-617 |
| GHSA-ph3r-5jfg-f84f vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core | Medium | Same weakness, CWE-617 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor