CVE-2023-1428: gRPC Reachable Assertion issue in Grpc.Core
Summary
CVE-2023-1428: gRPC Reachable Assertion issue. Affects Grpc.Core versions < 2.52.0. Fixed in 2.52.0. How to fix ↓
Also tracked for
- grpcio · PyPI
- io.grpc:grpc-protobuf · Maven
The same CVE-2023-1428 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grpc.Core is a package in the NuGet ecosystem that provides support for gRPC (Google Remote Procedure Call), a high-performance, open-source framework for building distributed applications. It allows developers to define services using Protocol Buffers and enables communication between clients and servers across different programming languages. This vulnerability affects versions prior to 2.52.0 of Grpc.Core.
Vulnerability Detail
The gRPC Reachable Assertion issue in Grpc.Core allows an attacker to trigger an abort() function call, leading to a denial of service (DoS) condition. The vulnerability arises when certain headers are sent to gRPC's C++ implementation via http2. Specifically, the headers 'te', ':scheme', and 'grpclb_client_stats' can cause the C++ implementation to abort() if their values meet certain conditions. Additionally, a subsequent header must be sent to exceed a total header size of 8KB. This vulnerability has a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How To Fix
Latest published version: 2.46.6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.52.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a non-vulnerable version of Grpc.Core.
Conclusion
The gRPC Reachable Assertion issue in Grpc.Core poses a significant vulnerability that can lead to a denial of service (DoS) condition. It is crucial to upgrade to a non-vulnerable version of Grpc.Core (2.52.0 or above) to mitigate this issue. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Grpc.Core →
FAQ
gRPC is an open-source framework for building distributed applications. It allows developers to define services using Protocol Buffers and facilitates communication between clients and servers across different programming languages.
The vulnerability can lead to a denial of service (DoS) condition, causing the affected gRPC service to become unresponsive or crash.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There are no known exploits for this vulnerability at the time of this advisory. However, it is crucial to apply the recommended fix to prevent potential attacks.
You can find more information about this vulnerability, including its technical details and affected package versions, in the advisory published by the GitHub Advisory Database. The link to the advisory is provided in the 'database_specific' field of the affected package.
References
Related vulnerabilities
Recent vulnerabilities recorded for Grpc.Core.
