GHSA-9hxf-ppjv-w6rq CVE-2023-32732 PYSEC-2026-1426

gRPC connection termination issue

Medium MavenPyPIRubyGems

Severity: 5.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.53%; Chance of exploitation in the next 30 days. Higher than 44.64% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-440 Expected Behavior Violation
Fix: Available; 3 packages have a fixed version

Description

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.

Affected versions

Maven

Package	Vulnerable	Fixed in
io.grpc:grpc-protobuf	`>= 1.53.0, < 1.53.1`	`1.53.1`
io.grpc:grpc-protobuf	`>= 1.54.0, < 1.54.2`	`1.54.2`

PyPI

Package	Vulnerable	Fixed in
grpcio	`>= 1.53.0, < 1.53.1`	`1.53.1`
grpcio	`>= 1.54.0, < 1.54.2`	`1.54.2`
grpcio	`>= 1.53.0, < 1.53.1` `>= 1.54.0, < 1.54.2`	`1.53.1` `1.54.2`

RubyGems

Package	Vulnerable	Fixed in
grpc	`>= 1.53.0, < 1.53.1`	`1.53.1`
grpc	`>= 1.54.0, < 1.54.2`	`1.54.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

io.grpc:grpc-protobuf Maven → `1.53.1`

maven

<dependency><groupId>io.grpc</groupId><artifactId>grpc-protobuf</artifactId><version>1.53.1</version></dependency>

gradle

implementation("io.grpc:grpc-protobuf:1.53.1")

grpcio PyPI → `1.53.1`

pip

pip install --upgrade "grpcio>=1.53.1"

poetry

poetry add "grpcio>=1.53.1"

uv

uv add "grpcio>=1.53.1"

grpc RubyGems → `1.53.1`

bundler

bundle update grpc # Gemfile: gem "grpc", ">= 1.53.1"

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-440: Expected Behavior Violation

A feature, API, or function does not perform according to its specification.

References

Advisories

Packages

pypi.org/project/grpcio

Timeline

Jul 6, 2023 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-p25m-jpj4-qcrr Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)	High	Also affects grpc
GHSA-496j-2rq6-j6cc Excessive Iteration in gRPC	High	Also affects grpc
GHSA-6628-q6j9-w8vg gRPC Reachable Assertion issue	High	Also affects grpc
GHSA-cfgp-2977-2fmm Connection confusion in gRPC	High	Also affects grpc
GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden	High	Same weakness, CWE-440
GHSA-rxmx-g7hr-8mx4 OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders	Medium	Same weakness, CWE-440
GHSA-q9p4-hw9m-fj2v Apollo Router vulnerable to Critical Regression In Query Plan Cache	Critical	Same weakness, CWE-440
GHSA-9hg2-395j-83rm Expected Behavior Violation in Apache Tomcat	Critical	Same weakness, CWE-440

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor