Grpc vulnerabilities

Products

• Grpc 15
• Grpc-node 6
• Grpc-go 4

Newest

• grpc grpc-node @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized CVE-2026-101916 Fix available 7.4 HighSeptember 28, 2026
• grpc grpc-node @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages CVE-2026-101915 Fix available 3.7 LowSeptember 28, 2026
• grpc grpc-node @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches CVE-2026-101914 Fix available 6.5 MediumSeptember 28, 2026
• grpc grpc-go gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers CVE-2026-84445 Fix available 8.7 HighSeptember 4, 2026
• grpc grpc-go gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation CVE-2026-84304 Fix available 8.7 HighSeptember 1, 2026
• grpc grpc-go gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion CVE-2026-84303 Fix available 6.3 MediumSeptember 1, 2026
• grpc grpc-node @grpc/grps-js: A malformed request can cause a server crash CVE-2026-48068 Fix available 7.5 HighJune 11, 2026
• grpc grpc-node @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash CVE-2026-48069 Fix available 7.5 HighJune 11, 2026
• grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 more gRPC-Go has an authorization bypass via missing leading slash in :path CVE-2026-33186 Public exploitFix available 9.1 CriticalMarch 18, 2026
• grpc, grpc grpc-c++ +1 more Denial of Service through Data corruption in gRPC-C++ CVE-2024-11407 Fix available 6.9 MediumNovember 26, 2024
• google grpc HPACK table poisoning in gRPC C++, Python & Ruby CVE-2024-7246 Fix available 6.3 MediumAugust 6, 2024
• grpc, grpc grpc-node +1 more @grpc/grpc-js can allocate memory for incoming messages well above configured limits CVE-2024-37168 Fix available 5.3 MediumJune 10, 2024
• google grpc Denial of Service in gRPC Core CVE-2023-4785 Fix available 7.5 HighSeptember 13, 2023
• google grpc Denial-of-Service in gRPC CVE-2023-33953 Fix available 7.5 HighAugust 9, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• google grpc Information leak in gRPC CVE-2023-32731 Fix available 7.4 HighJune 9, 2023
• google grpc, fedoraproject fedora +1 more Denial-of-Service in gRPC CVE-2023-32732 Fix available 5.3 MediumJune 9, 2023
• google grpc Denial-of-Service in gRPC CVE-2023-1428 Fix available 7.5 HighJune 9, 2023
• grpc grpc-swift, linuxfoundation grpc swift +1 more Denial of Service via reachable assertion in grpc-swift CVE-2022-24777 Fix available 7.5 HighMarch 25, 2022
• google grpc Prototype Pollution CVE-2020-7768 Fix available 7.5 HighNovember 11, 2020
• grpc Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow... CVE-2017-9431 Fix available 9.8 CriticalJune 5, 2017
• grpc Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free... CVE-2017-8359 Fix available 9.8 CriticalApril 30, 2017
• grpc Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core... CVE-2017-7861 Fix available 9.8 CriticalApril 14, 2017
• grpc Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow... CVE-2017-7860 Fix available 9.8 CriticalApril 14, 2017