GHSA-p25m-jpj4-qcrr CVE-2023-4785 PYSEC-2026-1428
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.77%
- Chance of exploitation in the next 30 days. Higher than 55.74% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-248 Uncaught Exception
- Fix
- Available
- 2 packages have a fixed version
Description
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| grpcio | >= 1.55.0, < 1.55.3 |
1.55.3 |
| grpcio | >= 1.54.0, < 1.54.3 |
1.54.3 |
| grpcio | >= 1.53.0, < 1.53.2 |
1.53.2 |
| grpcio | >= 1.55.0, < 1.55.3>= 1.54.0, < 1.54.3>= 1.53.0, < 1.53.2 |
1.53.21.54.31.55.3 |
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| grpc | >= 1.56.0, < 1.56.2 |
1.56.2 |
| grpc | >= 1.55.0, < 1.55.3 |
1.55.3 |
| grpc | >= 1.54.0, < 1.54.3 |
1.54.3 |
| grpc | >= 1.53.0, < 1.53.2 |
1.53.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
grpcio PyPI → 1.55.3
- pip
pip install --upgrade "grpcio>=1.55.3"- poetry
poetry add "grpcio>=1.55.3"- uv
uv add "grpcio>=1.55.3"
grpc RubyGems → 1.56.2
- bundler
bundle update grpc # Gemfile: gem "grpc", ">= 1.56.2"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
References
Advisories
Packages
Other links
- github.com/grpc/grpc/pull/33656
- github.com/grpc/grpc/pull/33667
- github.com/grpc/grpc/pull/33669
- github.com/grpc/grpc/pull/33670
- github.com/grpc/grpc/pull/33672
- github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-4785.yml
- groups.google.com/g/grpc-io/c/LlLkB1CeE4U
- rubygems.org/gems/grpc/versions/1.53.2
- rubygems.org/gems/grpc/versions/1.54.3
- rubygems.org/gems/grpc/versions/1.55.3
- rubygems.org/gems/grpc/versions/1.56.2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-496j-2rq6-j6cc Excessive Iteration in gRPC | High | Also affects grpc |
| GHSA-9hxf-ppjv-w6rq gRPC connection termination issue | Medium | Also affects grpc |
| GHSA-6628-q6j9-w8vg gRPC Reachable Assertion issue | High | Also affects grpc |
| GHSA-cfgp-2977-2fmm Connection confusion in gRPC | High | Also affects grpc |
| GHSA-8hrf-8g6f-7xwp Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message | High | Same weakness, CWE-248 |
| GHSA-27r3-jxmh-p828 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body | High | Same weakness, CWE-248 |
| GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type | Medium | Same weakness, CWE-248 |
| GHSA-55wc-3pg8-jfw6 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor | High | Same weakness, CWE-248 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor