Grpc (Grpc) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 936 known versions, newest CVE from 2026-03-20. Vendor: Grpc.
CVEs of Grpc
- CVE-2026-33186 - CVSS 9.1 (critical), 2026-03-20: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the…
- CVE-2024-11407 - CVSS 7.5 (high), 2024-11-26: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg…
- CVE-2024-7246 - CVSS 6.3 (medium), 2024-08-06: It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see…
- CVE-2024-37168 - CVSS 5.3 (medium), 2024-06-10: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two…
- CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
- CVE-2023-4785 - CVSS 7.5 (high), 2023-09-13: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial…
- CVE-2023-33953 - CVSS 7.5 (high), 2023-08-09: gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional…
- CVE-2023-32731 - CVSS 7.5 (high), 2023-06-09: When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be…
- CVE-2023-1428 - CVSS 7.5 (high), 2023-06-09: There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via…
- CVE-2023-32732 - CVSS 5.3 (medium), 2023-06-09: gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for…
- CVE-2020-7768 - CVSS 9.8 (critical), 2020-11-11: The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
- CVE-2017-9431 - CVSS 9.8 (critical), 2017-06-05: Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c.
- CVE-2017-8359 - CVSS 9.8 (critical), 2017-04-30: Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in…
- CVE-2017-7860 - CVSS 9.8 (critical), 2017-04-14: Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in…
- CVE-2017-7861 - CVSS 9.8 (critical), 2017-04-14: Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.
