Every CVE Search/ Get API key

CVE-2024-11407

Denial of Service through Data corruption in gRPC-C++

6.9 MediumFix available

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.57%Up 0.5 points since Nov 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.9

Denial of Service through Data corruption in gRPC-C++

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
CVE-2024-11407
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green
Weakness
CWE-682
Updated
2026-11-02
EUVDEUVD-2024-33797 6.9

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
EUVD-2024-33797
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green
Updated
2026-11-03
GitHub AdvisoriesGHSA-p9rf-64qj-22rw 6.9

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with...

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
GHSA-p9rf-64qj-22rw
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-682
Updated
2026-11-02
NVD 6.9

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
CVE-2024-11407
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-682
Updated
2026-11-02
OSVBELL-CVE-2024-11407 7.5
Record
BELL-CVE-2024-11407
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.9

Denial of Service through Data corruption in gRPC-C++

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
CVE-2024-11407
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green
Weakness
CWE-682
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2024-11407 7.5

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
DEBIAN-CVE-2024-11407
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2573 5.3

grpc security update

gRPC is a modern open source high performance RPC framework that can run in any environment. It can efficiently connect services in and across data centers with pluggable support for load balancing, tracing, health checking and authentication. It is also applicable in last mile of distributed computing to connect devices, mobile applications and browsers to backend services.

Security Fix(es):

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791(CVE-2024-11407)

Record
OESA-2024-2573
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:0340 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2025:0340
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:1019 5.3

Red Hat Security Advisory: Satellite 6.16.2 Async Update

Record
RHSA-2025:1019
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-11407 6.9

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
UBUNTU-CVE-2024-11407
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/S:N/AU:N/R:A/RE:L/U:Green
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-53456 No score

CVE-2024-11407 affecting package grpc for versions less than 1.62.0-4

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Record
AZL-53456
Updated
2026-11-05
OSVopenSUSE-SU-2025:15031-1 No score

python311-grpcio-1.69.0-2.1 on GA media

These are all security issues fixed in the python311-grpcio-1.69.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15031-1
Updated
2026-11-02
OSVSUSE-SU-2024:4393-1 No score

Security update for python-grpcio

This update for python-grpcio fixes the following issues:

  • CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
  • CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
Record
SUSE-SU-2024:4393-1
Updated
2026-11-02
OSVSUSE-SU-2024:4400-1 No score

Security update for grpc

This update for grpc fixes the following issues:

  • CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
  • CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
Record
SUSE-SU-2024:4400-1
Updated
2026-11-02
OSVSUSE-SU-2024:4401-1 No score

Security update for grpc

This update for grpc fixes the following issues:

  • CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
  • CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
Record
SUSE-SU-2024:4401-1
Updated
2026-11-02
OSVSUSE-SU-2024:4428-1 No score

Security update for python-grpcio

This update for python-grpcio fixes the following issues:

  • CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
  • CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
Record
SUSE-SU-2024:4428-1
Updated
2026-11-02
OSVSUSE-SU-2024:4429-1 No score

Security update for python-grpcio

This update for python-grpcio fixes the following issues:

  • CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
  • CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
Record
SUSE-SU-2024:4429-1
Updated
2026-11-02
OSVSUSE-SU-2024:4436-1 No score

Security update for grpc

This update for grpc fixes the following issues:

  • CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919)
  • CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821)
Record
SUSE-SU-2024:4436-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
grpc
Azure Linux:3
 before 1.62.0-4
1.62.0-4
grpc
Alpaquita:23
 1.59.3-r0 and later None known
grpc
Alpaquita:stream
 1.56.0-r2 up to 1.71.0-r0
1.71.0-r0
grpc
BellSoft Hardened Containers:stream
 1.56.0-r2 up to 1.71.0-r0
1.71.0-r0
grpc
Debian:14
 All versions, plus listed versions
1.51.1-101.51.1-61.51.1-71.51.1-81.51.1-9
Show 4 moreShow less
1.59.5-11.82.0-11.83.0-11.83.0-2
 None known
grpc
openEuler:24.03-LTS
 before 1.60.0-5.oe2403
1.60.0-5.oe2403
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:4.6.6-1.el8ap
0:4.6.6-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:4.6.6-1.el9ap
0:4.6.6-1.el9ap
python3.11-aiohttp
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:3.10.11-1.el8ap
0:3.10.11-1.el8ap
python3.11-aiohttp-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:3.10.11-1.el8ap
0:3.10.11-1.el8ap
Show 43 moreShow less
Affected packages
PackageAffectedFixed
python3.11-aiohttp-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:3.10.11-1.el8ap
0:3.10.11-1.el8ap
python3.11-aiohttp
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:3.10.11-1.el9ap
0:3.10.11-1.el9ap
python3.11-aiohttp-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:3.10.11-1.el9ap
0:3.10.11-1.el9ap
python3.11-aiohttp-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:3.10.11-1.el9ap
0:3.10.11-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 5 CVEs
 before 0:2.5.20250115-1.el8ap
0:2.5.20250115-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 5 CVEs
 before 0:2.5.20250115-1.el9ap
0:2.5.20250115-1.el9ap
python-grpcio
Red Hat:satellite_capsule:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python-grpcio-debugsource
Red Hat:satellite_capsule:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python3.11-grpcio
Red Hat:satellite_capsule:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python3.11-grpcio-debuginfo
Red Hat:satellite_capsule:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python-grpcio
Red Hat:satellite:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python-grpcio-debugsource
Red Hat:satellite:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python3.11-grpcio
Red Hat:satellite:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python3.11-grpcio-debuginfo
Red Hat:satellite:6.16::el8
 before 0:1.68.1-1.el8pc
0:1.68.1-1.el8pc
python-grpcio
Red Hat:satellite_capsule:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python-grpcio-debugsource
Red Hat:satellite_capsule:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python3.11-grpcio
Red Hat:satellite_capsule:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python3.11-grpcio-debuginfo
Red Hat:satellite_capsule:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python-grpcio
Red Hat:satellite:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python-grpcio-debugsource
Red Hat:satellite:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python3.11-grpcio
Red Hat:satellite:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python3.11-grpcio-debuginfo
Red Hat:satellite:6.16::el9
 before 0:1.68.1-1.el9pc
0:1.68.1-1.el9pc
python-grpcio
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 2 CVEs
 before 1.60.1-150600.16.8.1
1.60.1-150600.16.8.1
python-grpcio
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.60.1-150600.16.8.1
1.60.1-150600.16.8.1
grpc
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 2 CVEs
 before 1.60.0-150400.8.8.1
1.60.0-150400.8.8.1
grpc
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 2 CVEs
 before 1.60.0-150600.15.3.1
1.60.0-150600.15.3.1
grpc
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.60.0-150600.15.3.1
1.60.0-150600.15.3.1
python-grpcio
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 2 CVEs
 before 1.60.1-150400.9.10.1
1.60.1-150400.9.10.1
python-grpcio
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 2 CVEs
 before 1.60.1-150500.12.6.1
1.60.1-150500.12.6.1
python-grpcio
SUSE:Linux Enterprise Module for Python 3 15 SP5
From an advisory covering 2 CVEs
 before 1.60.1-150500.12.6.1
1.60.1-150500.12.6.1
python-grpcio
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 1.60.1-150500.12.6.1
1.60.1-150500.12.6.1
grpc
SUSE:Linux Enterprise Module for Basesystem 15 SP5
From an advisory covering 2 CVEs
 before 1.60.0-150500.11.8.1
1.60.0-150500.11.8.1
grpc
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 2 CVEs
 before 1.60.0-150500.11.8.1
1.60.0-150500.11.8.1
grpc
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 1.60.0-150500.11.8.1
1.60.0-150500.11.8.1
grpc
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.2-10.11.1-1
 None known
grpc
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.3.2-11.3.2-1ubuntu11.3.2-1.1~build1
 None known
grpc
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.16.1-11.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu5
 None known
grpc
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.30.2-31.30.2-3build11.30.2-3build31.30.2-3build51.30.2-3build6
 None known
grpc
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.51.1-3build31.51.1-3build41.51.1-41.51.1-4build11.51.1-4build21.51.1-4.1build31.51.1-4.1build41.51.1-4.1build5
 None known
grpc
Ubuntu:25.10
 All versions, plus listed versions
1.51.1-61.51.1-6build1
 None known
grpc
Ubuntu:26.10
 All versions, plus listed versions
1.51.1-8ubuntu11.51.1-91.51.1-9ubuntu31.51.1-10ubuntu1
 None known
grpc
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.51.1-6build11.51.1-71.51.1-7ubuntu21.51.1-7ubuntu31.51.1-8ubuntu1
 None known
python-grpcio
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.69.0-2.1
1.69.0-2.1

History

History
RecordedChangedSources
affected
factsOSV
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11407 is a medium vulnerability (CVSS 6.9) in Grpc, published November 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in grpc 1.62.0-4.

References

Show 55 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open