CVE-2023-32732: Denial-of-Service in gRPC
Denial-of-Service in gRPC
Other sources
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
— MITRE
gRPC is vulnerable to a denial of service, caused by a base64 encoding error for "-bin" suffixed headers. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a termination of connection between a HTTP2 proxy and a gRPC server, and results in a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2023-32732?
CVE-2023-32732 is a vulnerability in gRPC that allows a client to cause a termination of connection between a HTTP2 proxy and a gRPC server.
How severe is CVE-2023-32732?
CVE-2023-32732 has a severity rating of 5.3, which is considered medium.
Which software is affected by CVE-2023-32732?
The affected software includes grpc gem version up to 1.53.0, grpcio pip package up to 1.53.0, and io.grpc:grpc-protobuf maven package up to 1.53.0.
How can I fix CVE-2023-32732?
To fix CVE-2023-32732, it is recommended to upgrade the affected software to version 1.53.1 or higher.
Where can I find more information about CVE-2023-32732?
You can find more information about CVE-2023-32732 on the NIST National Vulnerability Database (NVD) and the GitHub links provided.