PT-2023-4873 · Google+3 · Grpc+3

Choeminji + 3 · Published 2023-06-09 · Updated 2026-02-18 · CVE-2023-32731

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions gRPC (affected versions not specified)

Description The issue arises when the gRPC HTTP2 stack encounters a header size exceeded error, causing it to skip parsing the rest of the HPACK frame. This results in a desynchronization of HPACK tables between the sender and receiver. If exploited, this could lead to requests from a proxy being interpreted as containing headers from different proxy clients, resulting in an information leak that can be used for privilege escalation or data exfiltration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-440

Related Identifiers

ALSA-2025_16880

ALT-PU-2025-4089

BDU:2023-05360

CVE-2023-32731

GHSA-CFGP-2977-2FMM

OPENSUSE-SU-2024:13621-1

OPENSUSE-SU-2024:13634-1

OPENSUSE-SU-2024_0573-1

RHSA-2024:10761

RHSA-2024_10761

SUSE-SU-2024:0573-1

Affected Products

Alt Linux

Red Hat

Suse

Grpc

References · 37

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-32731.yml · Exploit
• https://github.com/grpc/grpc/pull/32309 · Patch
• https://github.com/grpc/grpc/pull/33005 · Patch
• https://bdu.fstec.ru/vul/2023-05360 · Security Note
• https://osv.dev/vulnerability/GHSA-cfgp-2977-2fmm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32731 · Security Note
• https://ubuntu.com/security/CVE-2023-32731 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-32731 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32731 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-32731 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0573-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-32731 · Vendor Advisory
• https://github.com/grpc/grpc/commit/29d8beee0ac2555773b2a2dda5601c74a95d6c10 · Note
• https://github.com/grpc/grpc/releases/tag/v1.53.1 · Note
• https://github.com/grpc/grpc/releases/tag/v1.54.2 · Note