GHSA-cfgp-2977-2fmm CVE-2023-32731 PYSEC-2026-1427

Connection confusion in gRPC

High MavenPyPIRubyGems

Severity: 7.4 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.50%; Chance of exploitation in the next 30 days. Higher than 42.72% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-440 Expected Behavior Violation
Fix: Available; 3 packages have a fixed version

Description

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.

Affected versions

Maven

Package	Vulnerable	Fixed in
io.grpc:grpc-protobuf	`>= 1.53.0, < 1.53.1`	`1.53.1`
io.grpc:grpc-protobuf	`>= 1.54.0, < 1.54.2`	`1.54.2`

PyPI

Package	Vulnerable	Fixed in
grpcio	`>= 1.53.0, < 1.53.1`	`1.53.1`
grpcio	`>= 1.54.0, < 1.54.2`	`1.54.2`
grpcio	`>= 1.53.0, < 1.53.1` `>= 1.54.0, < 1.54.2`	`1.53.1` `1.54.2`

RubyGems

Package	Vulnerable	Fixed in
grpc	`>= 1.53.0, < 1.53.1`	`1.53.1`
grpc	`>= 1.54.0, < 1.54.2`	`1.54.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

io.grpc:grpc-protobuf Maven → `1.53.1`

maven

<dependency><groupId>io.grpc</groupId><artifactId>grpc-protobuf</artifactId><version>1.53.1</version></dependency>

gradle

implementation("io.grpc:grpc-protobuf:1.53.1")

grpcio PyPI → `1.53.1`

pip

pip install --upgrade "grpcio>=1.53.1"

poetry

poetry add "grpcio>=1.53.1"

uv

uv add "grpcio>=1.53.1"

grpc RubyGems → `1.53.1`

bundler

bundle update grpc # Gemfile: gem "grpc", ">= 1.53.1"

Severity breakdown

CVSS 3.1 7.4

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: High

Weakness

CWE-440: Expected Behavior Violation

A feature, API, or function does not perform according to its specification.

References

Advisories

Packages

pypi.org/project/grpcio

Timeline

Jul 5, 2023 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-p25m-jpj4-qcrr Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)	High	Also affects grpc
GHSA-496j-2rq6-j6cc Excessive Iteration in gRPC	High	Also affects grpc
GHSA-9hxf-ppjv-w6rq gRPC connection termination issue	Medium	Also affects grpc
GHSA-6628-q6j9-w8vg gRPC Reachable Assertion issue	High	Also affects grpc
GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden	High	Same weakness, CWE-440
GHSA-rxmx-g7hr-8mx4 OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders	Medium	Same weakness, CWE-440
GHSA-q9p4-hw9m-fj2v Apollo Router vulnerable to Critical Regression In Query Plan Cache	Critical	Same weakness, CWE-440
GHSA-9hg2-395j-83rm Expected Behavior Violation in Apache Tomcat	Critical	Same weakness, CWE-440

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor