Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-61xa-2pun-n3c9
Vulnerability ID VCID-61xa-2pun-n3c9
Aliases CVE-2023-32731
GHSA-cfgp-2977-2fmm
Summary Connection confusion in gRPC When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-440 Expected Behavior Violation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32731.json
epss 0.0007 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.0007 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
epss 0.00075 https://api.first.org/data/v1/epss?cve=CVE-2023-32731
cvssv3.1 7.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-cfgp-2977-2fmm
cvssv3.1 7.4 https://github.com/grpc/grpc/commit/29d8beee0ac2555773b2a2dda5601c74a95d6c10
generic_textual HIGH https://github.com/grpc/grpc/commit/29d8beee0ac2555773b2a2dda5601c74a95d6c10
cvssv3.1 7.4 https://github.com/grpc/grpc/commit/65a2a895afaf1d2072447b9baf246374b182a946
generic_textual HIGH https://github.com/grpc/grpc/commit/65a2a895afaf1d2072447b9baf246374b182a946
cvssv3 7.5 https://github.com/grpc/grpc/issues/33463
cvssv3.1 7.4 https://github.com/grpc/grpc/issues/33463
generic_textual HIGH https://github.com/grpc/grpc/issues/33463
cvssv3.1 7.4 https://github.com/grpc/grpc/pull/32309
generic_textual HIGH https://github.com/grpc/grpc/pull/32309
ssvc Track https://github.com/grpc/grpc/pull/32309
cvssv3.1 7.4 https://github.com/grpc/grpc/pull/33005
generic_textual HIGH https://github.com/grpc/grpc/pull/33005
ssvc Track https://github.com/grpc/grpc/pull/33005
cvssv3.1 7.4 https://github.com/grpc/grpc/releases/tag/v1.53.1
generic_textual HIGH https://github.com/grpc/grpc/releases/tag/v1.53.1
cvssv3.1 7.4 https://github.com/grpc/grpc/releases/tag/v1.54.2
generic_textual HIGH https://github.com/grpc/grpc/releases/tag/v1.54.2
cvssv3.1 7.4 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-32731.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-32731.yml
cvssv3.1 7.4 https://nvd.nist.gov/vuln/detail/CVE-2023-32731
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-32731
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32731.json
https://api.first.org/data/v1/epss?cve=CVE-2023-32731
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/grpc/grpc/commit/29d8beee0ac2555773b2a2dda5601c74a95d6c10
https://github.com/grpc/grpc/commit/65a2a895afaf1d2072447b9baf246374b182a946
https://github.com/grpc/grpc/issues/33463
https://github.com/grpc/grpc/pull/32309
https://github.com/grpc/grpc/pull/33005
https://github.com/grpc/grpc/releases/tag/v1.53.1
https://github.com/grpc/grpc/releases/tag/v1.54.2
2214463 https://bugzilla.redhat.com/show_bug.cgi?id=2214463
CVE-2023-32731 https://nvd.nist.gov/vuln/detail/CVE-2023-32731
CVE-2023-32731.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-32731.yml
GHSA-cfgp-2977-2fmm https://github.com/advisories/GHSA-cfgp-2977-2fmm
RHSA-2024:10761 https://access.redhat.com/errata/RHSA-2024:10761
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32731.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/grpc/grpc/commit/29d8beee0ac2555773b2a2dda5601c74a95d6c10
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/grpc/grpc/commit/65a2a895afaf1d2072447b9baf246374b182a946
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/grpc/grpc/issues/33463
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/grpc/grpc/pull/32309
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-26T19:07:16Z/ Found at https://github.com/grpc/grpc/pull/32309
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/grpc/grpc/pull/33005
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-26T19:07:16Z/ Found at https://github.com/grpc/grpc/pull/33005
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/grpc/grpc/releases/tag/v1.53.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/grpc/grpc/releases/tag/v1.54.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-32731.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-32731
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.21571
EPSS Score 0.0007
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:51:29.960970+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/grpc/CVE-2023-32731.yml 38.0.0