Grpc · Grpc · CVE-2024-7246
**Name of the Vulnerable Software and Affected Versions**
gRPC versions prior to 1.58.3
gRPC versions prior to 1.59.5
gRPC versions prior to 1.60.2
gRPC versions prior to 1.61.3
gRPC versions prior to 1.62.3
gRPC versions prior to 1.63.2
gRPC versions prior to 1.64.3
gRPC versions prior to 1.65.4
**Description**
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this issue to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent added headers in the first request being poisoned until cleared from the HPACK table.
**Recommendations**
Update to version 1.58.3 or later to resolve the issue.
Update to version 1.59.5 or later to resolve the issue.
Update to version 1.60.2 or later to resolve the issue.
Update to version 1.61.3 or later to resolve the issue.
Update to version 1.62.3 or later to resolve the issue.
Update to version 1.63.2 or later to resolve the issue.
Update to version 1.64.3 or later to resolve the issue.
Update to version 1.65.4 or later to resolve the issue.