CVE-2023-1428

Denial-of-Service in gRPC

7.5 HighFix available

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.41%Up 0.4 points since Jun 10, 2023

What each source reports

CVE List Score used 7.5

Denial-of-Service in gRPC

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

Record: CVE-2023-1428
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

EUVDEUVD-2023-1972 7.5

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

Record: EUVD-2023-1972
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6628-q6j9-w8vg 7.5

gRPC Reachable Assertion issue

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

Record: GHSA-6628-q6j9-w8vg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

NVD 7.5

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

Record: CVE-2023-1428
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

OSVBELL-CVE-2023-1428 7.5

Record: BELL-CVE-2023-1428
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Denial-of-Service in gRPC

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

Record: CVE-2023-1428
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-6628-q6j9-w8vg 7.5

gRPC Reachable Assertion issue

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

Record: GHSA-6628-q6j9-w8vg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

OSVPYSEC-2026-1425 7.5

gRPC Reachable Assertion issue

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

Record: PYSEC-2026-1425
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:10761 7.5

Red Hat Security Advisory: rhc-worker-playbook security update

Record: RHSA-2024:10761
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-1428 7.5

There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.

Record: UBUNTU-CVE-2023-1428
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`io.grpc:grpc-protobuf` Maven	1.51.0 up to 1.53.0	1.53.0
`grpcio` PyPI	1.51.0 up to 1.53.0	1.53.0
`grpc` RubyGems	1.51.0 up to 1.53.0	1.53.0
`grpc` Alpaquita:23	1.50.1-r1 up to 1.59.3-r0	1.59.3-r0
`io.grpc:grpc-protobuf` Maven	1.51.0 up to 1.53.0, plus listed versions 1.51.11.51.31.52.01.52.1	1.53.0
`grpcio` PyPI	1.51.0 up to 1.53.0, plus listed versions 1.51.11.51.31.52.01.52.0rc11.53.0rc2	1.53.0
`grpc` RubyGems	1.51.0 up to 1.53.0, plus listed versions 1.52.01.52.0.pre21.52.21.53.0.pre2	1.53.0
`rhc-worker-playbook` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:0.1.10-1.el9_5	0:0.1.10-1.el9_5
`rhc-worker-playbook-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:0.1.10-1.el9_5	0:0.1.10-1.el9_5
`grpc` Ubuntu:16.04:LTS	All versions, plus listed versions 0.10.2-10.11.1-1	None known

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`grpc` Ubuntu:18.04:LTS	All versions, plus listed versions 1.3.2-11.3.2-1ubuntu11.3.2-1.1~build1	None known
`grpc` Ubuntu:20.04:LTS	All versions, plus listed versions 1.16.1-11.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu5	None known
`grpc` Ubuntu:22.04:LTS	All versions, plus listed versions 1.30.2-31.30.2-3build11.30.2-3build31.30.2-3build51.30.2-3build6	None known
`grpc` Ubuntu:24.04:LTS	All versions, plus listed versions 1.51.1-3build31.51.1-3build41.51.1-41.51.1-4build11.51.1-4build21.51.1-4.1build31.51.1-4.1build41.51.1-4.1build5	None known
`grpc` Ubuntu:25.10	All versions, plus listed versions 1.51.1-61.51.1-6build1	None known
`grpc` Ubuntu:26.10	All versions, plus listed versions 1.51.1-8ubuntu11.51.1-91.51.1-9ubuntu31.51.1-10ubuntu1	None known
`grpc` Ubuntu:26.04:LTS	All versions, plus listed versions 1.51.1-6build11.51.1-71.51.1-7ubuntu21.51.1-7ubuntu31.51.1-8ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-1428 is a high vulnerability (CVSS 7.5) in Google Grpc, published June 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in io.grpc:grpc-protobuf 1.53.0.

References

Show 26 moreShow less