Is grpcio safe ? 5 known vulnerabilities, worst severity HIGH.
// reach 2 direct dependencies
none carry a known advisory
403 packages depend on it
an advisory here reaches each of them
authzed bentoml flwr opentelemetry-exporter-otlp-proto-grpc rasa-sdk th2-data-services-lwdp // ai model usage No published models are known to use this package.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 56th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-p25m-jpj4-qcrr, the advisory selected below
// 5 advisories GHSA-p25m-jpj4-qcrr Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. HIGH GHSA-496j-2rq6-j6cc gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: HIGH GHSA-6628-q6j9-w8vg There exists an vulnerability causing an abort() to be called in gRPC. HIGH GHSA-cfgp-2977-2fmm When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy cli HIGH GHSA-9hxf-ppjv-w6rq gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309. MODE Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High Checked 2026-11-06 at 23:06 UTC. The most recent advisory here was published 2023-09-13. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page