CVE-2023-32732: gRPCio Connection Termination Vulnerability
Summary
CVE-2023-32732: gRPC connection termination issue. Affects grpcio across 2 version ranges.
>= 1.53.0, < 1.53.1
>= 1.54.0, < 1.54.2
Fixed in 1.53.1 or 1.54.2, depending on the release line you run. How to fix ↓
Also tracked for
- Grpc.Core · NuGet
- io.grpc:grpc-protobuf · Maven
- io.grpc:grpc-protobuf · Maven
- grpc · Debian:11
The same CVE-2023-32732 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gRPCio is a high-performance, open-source universal RPC framework that enables efficient communication between services. It is widely used for building microservices and supports multiple programming languages. The framework leverages HTTP/2 for transport, allowing features like multiplexing and streaming. However, gRPCio is susceptible to a specific vulnerability that can lead to unintended disconnections between clients and servers.
Vulnerability Detail
The vulnerability arises from a base64 encoding error related to headers suffixed with '-bin'. When a client sends such headers, the gRPC server may terminate the connection, even though HTTP/2 proxies typically allow this behavior. This disconnection can disrupt service communication and lead to service downtime, affecting application reliability and user experience.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.53.0, < 1.53.11.53.1pip install --upgrade "grpcio==1.53.1" -
>= 1.54.0, < 1.54.21.54.2pip install --upgrade "grpcio==1.54.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can avoid using headers with the '-bin' suffix until you can upgrade to a patched version. This will help prevent disconnections caused by the vulnerability.
Conclusion
The gRPCio vulnerability CVE-2023-32732 poses a risk of connection termination due to a base64 encoding error in specific headers. It is crucial to upgrade to the patched versions to ensure the reliability of your applications and avoid service disruptions.
See every vulnerability recorded for grpcio →
FAQ
CVE-2023-32732 is a vulnerability in the gRPCio package that can cause connection termination between a client and a gRPC server due to a base64 encoding error.
This vulnerability can lead to unexpected disconnections, which may disrupt service communication and affect the overall reliability of your application.
Versions 1.53.0 and 1.54.0 are affected. It is recommended to upgrade to 1.53.1 or 1.54.2 to mitigate the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for grpcio.
