Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qatb-my8j-b3hr
Vulnerability ID VCID-qatb-my8j-b3hr
Aliases CVE-2023-1428
GHSA-6628-q6j9-w8vg
Summary gRPC Reachable Assertion issue There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-617 Reachable Assertion
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1428.json
epss 0.00073 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00073 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-1428
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-6628-q6j9-w8vg
cvssv3.1 7.5 https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
generic_textual HIGH https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
ssvc Track https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
cvssv3 7.5 https://github.com/grpc/grpc/issues/33463
cvssv3.1 7.5 https://github.com/grpc/grpc/issues/33463
generic_textual HIGH https://github.com/grpc/grpc/issues/33463
cvssv3.1 7.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428.yml
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-1428
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-1428
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1428.json
https://api.first.org/data/v1/epss?cve=CVE-2023-1428
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
https://github.com/grpc/grpc/issues/33463
2214473 https://bugzilla.redhat.com/show_bug.cgi?id=2214473
CVE-2023-1428 https://nvd.nist.gov/vuln/detail/CVE-2023-1428
CVE-2023-1428.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428.yml
GHSA-6628-q6j9-w8vg https://github.com/advisories/GHSA-6628-q6j9-w8vg
RHSA-2024:10761 https://access.redhat.com/errata/RHSA-2024:10761
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-1428.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-26T18:57:29Z/ Found at https://github.com/grpc/grpc/commit/2485fa94bd8a723e5c977d55a3ce10b301b437f8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/grpc/grpc/issues/33463
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-1428.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-1428
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.22296
EPSS Score 0.00073
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:51:31.176480+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/grpc/CVE-2023-1428.yml 38.0.0