{"id":"CVE-2023-1428","aliases":["GHSA-6628-q6j9-w8vg","PYSEC-2026-1425"],"title":"gRPC Reachable Assertion issue","summary":"gRPC Reachable Assertion issue","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"grpc","product":"io.grpc:grpc-protobuf","ecosystem":"maven","affected":["io.grpc:grpc-protobuf >= 1.51.0, < 1.53.0","grpcio >= 1.51.0, < 1.53.0","grpc >= 1.51.0, < 1.53.0"],"patched":["io.grpc:grpc-protobuf 1.53.0","grpcio 1.53.0","grpc 1.53.0"],"published":"2023-07-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:54.880238612Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6628-q6j9-w8vg","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1428"},{"url":"https://github.com/grpc/grpc/issues/33463"},{"url":"https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428.yml"}],"tags":["osv","maven"],"epss":0.00412,"epssPercentile":0.35146,"ingestedAt":"2026-07-08T18:25:46.290Z","slug":"CVE-2023-1428","body":"## Overview\n\nThere exists an vulnerability causing an abort() to be called in gRPC. \nThe following headers cause gRPC's C++ implementation to abort() when called via http2:\n\nte: x (x != trailers)\n\n:scheme: x (x != http, https)\n\ngrpclb_client_stats: x (x == anything)\n\nOn top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.\n\n## Affected packages\n\n- `io.grpc:grpc-protobuf >= 1.51.0, < 1.53.0`\n- `grpcio >= 1.51.0, < 1.53.0`\n- `grpc >= 1.51.0, < 1.53.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.grpc:grpc-protobuf 1.53.0`\n- `grpcio 1.53.0`\n- `grpc 1.53.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}