CVE-2023-1428High· 7.5▾ TwilightgRPC Reachable Assertion issue
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
Last analysed / modified upstream
There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:
te: x (x != trailers)
:scheme: x (x != http, https)
grpclb_client_stats: x (x == anything)
On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
io.grpc:grpc-protobuf >= 1.51.0, < 1.53.0grpcio >= 1.51.0, < 1.53.0grpc >= 1.51.0, < 1.53.0Upgrade to a patched release:
io.grpc:grpc-protobuf 1.53.0grpcio 1.53.0grpc 1.53.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-32731High· 7.4Connection confusion in gRPC
CVE-2023-32732Medium· 5.3gRPC connection termination issue
CVE-2026-84445High· 8.7gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303MediumgRPC-Go is the Go language implementation of gRPC
CVE-2026-84304HighgRPC-Go is the Go language implementation of gRPC
GO-2026-6061NoneVulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc