Grpc
Monthly
Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. The vector is network-reachable with no privileges or user interaction required (AV:N/PR:N/UI:N), though high attack complexity (AC:H) reflects that a specific mTLS configuration and application reliance on getAuthContext are prerequisites; no public exploit has been identified at time of analysis, and vendor patches exist in 1.13.6 and 1.14.5.
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
Unsafe Erlang term deserialization in the elixir-grpc library (versions 0.4.0 through 1.0.0) allows unauthenticated remote attackers to crash the BEAM VM via atom-table exhaustion or achieve remote code execution by sending crafted gRPC payloads with Content-Type application/grpc+erlpack. The flaw lives in GRPC.Codec.Erlpack.decode/2, which calls :erlang.binary_to_term/1 without the :safe option, size bounds, or type guards. No public exploit is identified at time of analysis, but the upstream fix is published at commit 272a97a and a patched 1.0.0 release is available.
Denial of service in the elixir-grpc library (versions 0.4.0 through 0.x) allows unauthenticated remote attackers to crash BEAM nodes via a gzip decompression bomb. The GRPC.Compressor.Gzip module calls :zlib.gunzip/1 directly on attacker-controlled bytes without size limits, ratio checks, or incremental decoding, so a single small frame carrying the grpc-encoding: gzip header expands to multi-gigabyte allocations and triggers OOM kills. No public exploit identified at time of analysis, but a vendor patch is available in version 1.0.0.
Authorization bypass in elixir-grpc (grpc library for Elixir) versions 0.8.0 through 0.x allows authenticated attackers to override path-bound URL parameters via query string or request body values, defeating ownership and multi-tenancy checks. The flaw stems from incorrect Map.merge/2 precedence in GRPC.Server.Transcode.map_request/5, where attacker-controlled query/body values silently overwrite the router-extracted path bindings used by handlers for authorization. No public exploit identified at time of analysis, but upstream patch and detailed regression tests are publicly available.
Unauthenticated denial of service in the elixir-grpc library (versions 0.3.1 up to but not including 1.0.0) allows a single remote attacker to crash an Erlang/BEAM node by streaming an oversized or slow-trickle unary gRPC request body. The Cowboy handler's read_full_body/3 accumulates every chunk into one unbounded binary, and when no grpc-timeout header is sent the per-chunk read timeout collapses to :infinity, so memory grows without bound until the VM dies. No public exploit identified at time of analysis, but the fix is upstream in commit 49e18c3 and the issue is trivial to trigger.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.
There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable.
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
There exists an vulnerability causing an abort() to be called in gRPC. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/parse_address.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. The vector is network-reachable with no privileges or user interaction required (AV:N/PR:N/UI:N), though high attack complexity (AC:H) reflects that a specific mTLS configuration and application reliance on getAuthContext are prerequisites; no public exploit has been identified at time of analysis, and vendor patches exist in 1.13.6 and 1.14.5.
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
Unsafe Erlang term deserialization in the elixir-grpc library (versions 0.4.0 through 1.0.0) allows unauthenticated remote attackers to crash the BEAM VM via atom-table exhaustion or achieve remote code execution by sending crafted gRPC payloads with Content-Type application/grpc+erlpack. The flaw lives in GRPC.Codec.Erlpack.decode/2, which calls :erlang.binary_to_term/1 without the :safe option, size bounds, or type guards. No public exploit is identified at time of analysis, but the upstream fix is published at commit 272a97a and a patched 1.0.0 release is available.
Denial of service in the elixir-grpc library (versions 0.4.0 through 0.x) allows unauthenticated remote attackers to crash BEAM nodes via a gzip decompression bomb. The GRPC.Compressor.Gzip module calls :zlib.gunzip/1 directly on attacker-controlled bytes without size limits, ratio checks, or incremental decoding, so a single small frame carrying the grpc-encoding: gzip header expands to multi-gigabyte allocations and triggers OOM kills. No public exploit identified at time of analysis, but a vendor patch is available in version 1.0.0.
Authorization bypass in elixir-grpc (grpc library for Elixir) versions 0.8.0 through 0.x allows authenticated attackers to override path-bound URL parameters via query string or request body values, defeating ownership and multi-tenancy checks. The flaw stems from incorrect Map.merge/2 precedence in GRPC.Server.Transcode.map_request/5, where attacker-controlled query/body values silently overwrite the router-extracted path bindings used by handlers for authorization. No public exploit identified at time of analysis, but upstream patch and detailed regression tests are publicly available.
Unauthenticated denial of service in the elixir-grpc library (versions 0.3.1 up to but not including 1.0.0) allows a single remote attacker to crash an Erlang/BEAM node by streaming an oversized or slow-trickle unary gRPC request body. The Cowboy handler's read_full_body/3 accumulates every chunk into one unbounded binary, and when no grpc-timeout header is sent the per-chunk read timeout collapses to :infinity, so memory grows without bound until the VM dies. No public exploit identified at time of analysis, but the fix is upstream in commit 49e18c3 and the issue is trivial to trigger.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.
There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable.
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
There exists an vulnerability causing an abort() to be called in gRPC. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/parse_address.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.