Grpc - vulnerabilities (CVEs)

24 CVEs in 5 products, 3 in the last 30 days, newest from 2026-09-28.

Products

• Grpc - 15 CVEs
• Grpc-node - 6 CVEs
• Grpc-go - 4 CVEs
• Grpc-c - 1 CVEs
• Grpc-swift - 1 CVEs

Newest CVEs of Grpc

• CVE-2026-101916 - CVSS 7.4 (high), 2026-09-28: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not…
• CVE-2026-101915 - CVSS 3.7 (low), 2026-09-28: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method…
• CVE-2026-101914 - CVSS 6.5 (medium), 2026-09-28: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name)…
• CVE-2026-84445 - CVSS 8.7 (high), 2026-09-14: gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow…
• CVE-2026-84304 - CVSS 8.7 (high), 2026-09-01: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate…
• CVE-2026-84303 - CVSS 6.3 (medium), 2026-09-01: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header…
• CVE-2026-48069 - CVSS 7.5 (high), 2026-07-14: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and…
• CVE-2026-48068 - CVSS 7.5 (high), 2026-07-14: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and…
• CVE-2026-33186 - CVSS 9.1 (critical), 2026-03-20: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the…
• CVE-2024-11407 - CVSS 7.5 (high), 2024-11-26: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg…
• CVE-2024-7246 - CVSS 6.3 (medium), 2024-08-06: It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see…
• CVE-2024-37168 - CVSS 5.3 (medium), 2024-06-10: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two…
• CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
• CVE-2023-4785 - CVSS 7.5 (high), 2023-09-13: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial…
• CVE-2023-33953 - CVSS 7.5 (high), 2023-08-09: gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional…
• CVE-2023-32731 - CVSS 7.5 (high), 2023-06-09: When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be…
• CVE-2023-1428 - CVSS 7.5 (high), 2023-06-09: There exists an vulnerability causing an abort() to be called in gRPC.  The following headers cause gRPC's C++ implementation to abort() when called via…
• CVE-2023-32732 - CVSS 5.3 (medium), 2023-06-09: gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for…
• CVE-2022-24777 - CVSS 7.5 (high), 2022-03-25: grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to…
• CVE-2020-7768 - CVSS 9.8 (critical), 2020-11-11: The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
• CVE-2017-9431 - CVSS 9.8 (critical), 2017-06-05: Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c.
• CVE-2017-8359 - CVSS 9.8 (critical), 2017-04-30: Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in…
• CVE-2017-7860 - CVSS 9.8 (critical), 2017-04-14: Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in…
• CVE-2017-7861 - CVSS 9.8 (critical), 2017-04-14: Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c.