gRPC Connection Termination Vulnerability - CVE-2023-32732
Summary
CVE-2023-32732: gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC s... Affects grpc across 3 version ranges.
< 4ca6de0e8e52386301890b2860fb7a9a7c2c9b7c
< 357d7afc43fe0df74205b797525818fca8cd8f53
< 358bfb581feeda5bf17dd3b96da1074d84a6ef8d
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gRPC is a high-performance, open-source universal RPC framework that enables efficient communication between services. It uses HTTP/2 for transport, allowing for features like multiplexing and streaming. This vulnerability affects gRPC servers when they receive improperly encoded headers from clients, potentially leading to unexpected disconnections.
Vulnerability Detail
CVE-2023-32732 is a vulnerability in gRPC that allows a client to cause a disconnection between an HTTP/2 proxy and a gRPC server. This occurs due to a base64 encoding error for headers suffixed with '-bin'. While HTTP/2 proxies typically permit this behavior, it results in disconnection by the gRPC server, which can disrupt service availability and lead to denial-of-service conditions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the client side to ensure that headers are properly encoded before sending them to the gRPC server. This can help prevent the disconnection issue until a proper upgrade can be performed.
Conclusion
CVE-2023-32732 is a significant vulnerability in gRPC that can lead to service disruptions due to improper header encoding. It is crucial for users of gRPC to upgrade to a secure version and consider implementing workarounds until the upgrade is complete. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for grpc →
FAQ
CVE-2023-32732 is a vulnerability in gRPC that allows clients to cause disconnections between HTTP/2 proxies and gRPC servers due to improperly encoded headers.
This vulnerability can lead to unexpected disconnections, potentially causing service outages and denial-of-service conditions in applications using gRPC.
If you are using gRPC, you should upgrade to a patched version as soon as possible to mitigate this vulnerability.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
