Loading...
Skip to main content
GeekWala

CVE-2023-32731 — Connection confusion in grpc — CVE Details

HIGH

Connection confusion in gRPC

Published July 5, 2023Updated September 10, 2026Source: osv

Summary

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.

Advisory Timeline

  • First published July 5, 2023 (1195 days ago).
  • Last revised September 10, 2026 — 1162 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update grpc to 1.53.1 or later
gem install grpc -v 1.53.1
Bundler
Update grpc to 1.54.2 or later
gem install grpc -v 1.54.2
pip
Update grpcio to 1.54.2 or later
pip install "grpcio>=1.54.2"
pip
Update grpcio to 1.53.1 or later
pip install "grpcio>=1.53.1"
Maven
Update io.grpc:grpc-protobuf to 1.53.1 or later
<!-- Update pom.xml dependency version to 1.53.1 for io.grpc:grpc-protobuf -->
Maven
Update io.grpc:grpc-protobuf to 1.54.2 or later
<!-- Update pom.xml dependency version to 1.54.2 for io.grpc:grpc-protobuf -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (6)

Affects 3 ecosystems: maven (1), pypi (1), rubygems (1).

PackageEcosystemAffectedFixed In
grpc
rubygems
1.53.01.53.1
grpc
rubygems
1.54.01.54.2
grpcio
pypi
1.54.01.54.2
grpcio
pypi
1.53.01.53.1
io.grpc:grpc-protobuf
maven
1.53.01.53.1
io.grpc:grpc-protobuf
maven
1.54.0, 1.54.11.54.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.4 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

References

Frequently Asked Questions

What is CVE-2023-32731?
Connection confusion in gRPC This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.4/10).
How do I check if my project is affected by CVE-2023-32731?
CVE-2023-32731 affects grpc, grpcio and io.grpc:grpc-protobuf. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-32731 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.4

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-cfgp-2977-2fmm
PYSEC-2026-1427

Related CVEs

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies