Skip to content

gRPC contains a vulnerability CVE-2023-32732 #3038

Open

Description

@DirkRichter

Problem description

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading to v1.53.0 beyond the commit in grpc/grpc#32309

https://nvd.nist.gov/vuln/detail/cve-2023-32732

Activity

  1. murgatroid99 commented on Feb 6, 2026

    @murgatroid99
    Member

    I don't think grpc-js is impacted by this vulnerability. If you believe otherwise please provide more details.

  2. DirkRichter commented on Feb 9, 2026

    @DirkRichter
    Author

    Not sure. Our DependencyTrack races an CVE on v1.14.3:

    Image

    Maybe this is a false positive? Can someone confirm?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions