Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-1428: gRPC may crash with crafted HTTP/2 headers
CVE-2023-1428 · published 3 years ago
Summary
The C++ version of the gRPC library can stop working if it receives certain specially crafted HTTP/2 headers combined with a large overall header size. This could cause a service that relies on gRPC to become unavailable until it is restarted. Update the library to version 1.53 or later (or to the code after commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8) to prevent the problem.
What to do
- Update grpc io.grpc:grpc-protobuf to version 1.53.0.
- Update grpc authors grpc to version 1.53.0.
- Update the grpc authors grpcio to version 1.53.0.
- Update grpc grpc to version 1.53.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | grpc | io.grpc:grpc-protobuf |
>= 1.51.0, < 1.53.0 Fix: upgrade to 1.53.0
|
| rubygems | grpc authors | grpc |
>= 1.51.0, < 1.53.0 Fix: upgrade to 1.53.0
|
| – | grpc | grpc |
>= 1.51.0, < 1.53.0 cpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | grpc | All versions |
| Ubuntu:18.04:LTS | canonical | grpc | All versions |
| Ubuntu:20.04:LTS | canonical | grpc | All versions |
| Ubuntu:22.04:LTS | canonical | grpc | All versions |
| Ubuntu:24.04:LTS | canonical | grpc | All versions |
| Ubuntu:25.10 | canonical | grpc | All versions |
| Ubuntu:26.04 | canonical | grpc | All versions |
| pip | the grpc authors | grpcio |
>= 1.51.0, < 1.53.0 Fix: upgrade to 1.53.0
|
Original advisory text
Denial-of-Service in gRPC
There exists an vulnerability causing an abort() to be called in gRPC.
The following headers cause gRPC's C++ implementation to abort() when called via http2:
te: x (x != trailers)
:scheme: x (x != http, https)
grpclb_client_stats: x (x == anything)
On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
The following headers cause gRPC's C++ implementation to abort() when called via http2:
te: x (x != trailers)
:scheme: x (x != http, https)
grpclb_client_stats: x (x == anything)
On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
References
- https://github.com/grpc/grpc/issues/33463
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428....
- https://github.com/advisories/GHSA-6628-q6j9-w8vg
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1428.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-1428 Vendor Advisory
- https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8 Patch
- https://ubuntu.com/security/CVE-2023-1428 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-1428 Third Party Advisory
- https://github.com/grpc/grpc Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-617Reachable Assertion
Timeline
Published9 Jun 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
UBUNTU-CVE-2023-1428 · OSV
GHSA-6628-q6j9-w8vg · GHSA
CVE-2023-1428 · NVD
CVE-2023-1428 · OSV
Track software like this
Free during beta