CVE-2023-32731: gRPC Connection Confusion Vulnerability Leading to Information Leak
Summary
CVE-2023-32731: Connection confusion in gRPC. Affects grpcio across 2 version ranges.
>= 1.53.0, < 1.53.1
>= 1.54.0, < 1.54.2
Fixed in 1.53.1 or 1.54.2, depending on the release line you run. How to fix ↓
Also tracked for
- Grpc.Core · NuGet
- io.grpc:grpc-protobuf · Maven
The same CVE-2023-32731 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gRPC is a high-performance, open-source universal RPC framework that enables communication between applications in a distributed environment. It uses HTTP/2 for transport, allowing for multiplexing and efficient communication. However, gRPC's reliance on the HPACK compression format for header compression can introduce vulnerabilities, particularly when handling header size errors, as seen in this case.
Vulnerability Detail
The vulnerability arises from the gRPC HTTP2 stack's handling of header size exceeded errors. When such an error occurs, the stack skips parsing the remainder of the HPACK frame, leading to desynchronization of HPACK tables between the sender and receiver. This desynchronization can be exploited in scenarios involving proxies and backends, resulting in requests from the proxy being misinterpreted as containing headers from different proxy clients. This can lead to information leaks, privilege escalation, or data exfiltration.
How To Fix
Latest published version: 1.84.1 as of 23 Oct 2026
pip install --upgrade "grpcio==1.84.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.53.0, < 1.53.11.53.1pip install --upgrade "grpcio==1.53.1" -
>= 1.54.0, < 1.54.21.54.2pip install --upgrade "grpcio==1.54.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional validation on the headers being processed by your application to ensure that they are correctly associated with the intended clients, thereby mitigating the risk of information leakage.
Conclusion
In summary, the gRPC connection confusion vulnerability (CVE-2023-32731) poses a significant risk due to its potential for information leaks and privilege escalation. It is crucial to update to the patched versions of gRPC to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for grpcio →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
The vulnerability affects gRPC versions 1.53.0 and 1.54.0. It is fixed in versions 1.53.1 and 1.54.2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to information leaks, privilege escalation, and data exfiltration, posing significant security risks.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software by analyzing the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for grpcio.
