PT-2023-30643 · Google+2 · Grpc+2

Govulnbot

·

Published

2023-09-13

·

Updated

2026-02-18

·

CVE-2023-4785

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions gRPC versions 1.23 and later
Description The issue is related to a lack of error handling in the TCP server in Google's gRPC, which allows an attacker to cause a denial of service by initiating a significant number of connections with the server. This affects gRPC C++, Python, and Ruby, but does not affect gRPC Java and Go. The issue is present on posix-compatible platforms, such as Linux.
Recommendations For gRPC versions 1.23 and later, consider implementing proper error handling mechanisms in the TCP server to prevent denial of service attacks. As a temporary workaround, consider restricting the number of connections allowed to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

AZL-34772
CVE-2023-4785
ECHO-050A-2D98-BB04
GHSA-P25M-JPJ4-QCRR
OESA-2023-1682
OESA-2023-1726
OPENSUSE-SU-2024:13621-1
OPENSUSE-SU-2024:13634-1
OPENSUSE-SU-2024_0573-1
RHSA-2024:0797
SUSE-SU-2024:0573-1

Affected Products

Debian
Suse
Grpc