Denial of Service in gRPC Core
Priority MEDIUM 40CWE-248Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.
Summary
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00773 55th percentileScored 2026-11-07
Fix Fixed gRPC (Google): 1.57grpc (RubyGems): 1.56.2, 1.55.3, 1.54.3 +1+1 more productRed Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gRPC | 1.56.0 – 1.56.1; 1.55.0 – 1.55.2; 1.54.0 – 1.54.2; 1.53.0 – 1.53.1 | 1.57 | Patch available | CNA | |
| — | grpc (RubyGems) | 1.56.0 to before 1.56.2 | 1.56.2 | Patch available | GHSA-p25m-jpj4-qcrr |
| — | grpc (RubyGems) | 1.55.0 to before 1.55.3 | 1.55.3 | Patch available | GHSA-p25m-jpj4-qcrr |
| — | grpc (RubyGems) | 1.54.0 to before 1.54.3 | 1.54.3 | Patch available | GHSA-p25m-jpj4-qcrr |
| — | grpc (RubyGems) | 1.53.0 to before 1.53.2 | 1.53.2 | Patch available | GHSA-p25m-jpj4-qcrr |
| — | grpcio (PyPI) | 1.55.0 to before 1.55.3 | 1.55.3 | Patch available | GHSA-p25m-jpj4-qcrr |
| — | grpcio (PyPI) | 1.54.0 to before 1.54.3 | 1.54.3 | Patch available | GHSA-p25m-jpj4-qcrr |
| — | grpcio (PyPI) | 1.53.0 to before 1.53.2 | 1.53.2 | Patch available | GHSA-p25m-jpj4-qcrr |
- gRPC VendorGoogle Affected 1.56.0 – 1.56.1; 1.55.0 – 1.55.2; 1.54.0 – 1.54.2; 1.53.0 – 1.53.1 Fixed in 1.57 Patch available CNA
- grpc (RubyGems) Vendor— Affected 1.56.0 to before 1.56.2 Fixed in 1.56.2 Patch available GHSA-p25m-jpj4-qcrr
- grpc (RubyGems) Vendor— Affected 1.55.0 to before 1.55.3 Fixed in 1.55.3 Patch available GHSA-p25m-jpj4-qcrr
- grpc (RubyGems) Vendor— Affected 1.54.0 to before 1.54.3 Fixed in 1.54.3 Patch available GHSA-p25m-jpj4-qcrr
- grpc (RubyGems) Vendor— Affected 1.53.0 to before 1.53.2 Fixed in 1.53.2 Patch available GHSA-p25m-jpj4-qcrr
- grpcio (PyPI) Vendor— Affected 1.55.0 to before 1.55.3 Fixed in 1.55.3 Patch available GHSA-p25m-jpj4-qcrr
- grpcio (PyPI) Vendor— Affected 1.54.0 to before 1.54.3 Fixed in 1.54.3 Patch available GHSA-p25m-jpj4-qcrr
- grpcio (PyPI) Vendor— Affected 1.53.0 to before 1.53.2 Fixed in 1.53.2 Patch available GHSA-p25m-jpj4-qcrr
Remediation
- Fix · CNA gRPC (Google) Fixed in 1.57
- Fix · GHSA-p25m-jpj4-qcrr grpc (RubyGems) Fixed in 1.56.2 Advisory →
- Fix · GHSA-p25m-jpj4-qcrr grpc (RubyGems) Fixed in 1.55.3 Advisory →
- Fix · GHSA-p25m-jpj4-qcrr grpc (RubyGems) Fixed in 1.54.3 Advisory →
- Fix · GHSA-p25m-jpj4-qcrr grpc (RubyGems) Fixed in 1.53.2 Advisory →
- Fix · GHSA-p25m-jpj4-qcrr grpcio (PyPI) Fixed in 1.55.3 Advisory →
- Fix · GHSA-p25m-jpj4-qcrr grpcio (PyPI) Fixed in 1.54.3 Advisory →
- Fix · GHSA-p25m-jpj4-qcrr grpcio (PyPI) Fixed in 1.53.2 Advisory →
Red Hat 1 advisory
- RHSA-2024:0797 Released 2024-02-13 · Red Hat rating ImportantSatellite 6.14.2 Async Security Update
- Red Hat Satellite 6.14 for RHEL 8 candlepin-4.3.11-1.el8sat, candlepin-selinux-4.3.11-1.el8sat, mosquitto-2.0.17-1.el8sat +5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2024:0797 |
Not affected: 2 products
- Red Hat OpenShift Container Platform 4
- Red Hat Satellite 6.14 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4785
- 2026-10-03 Alias added: GHSA-p25m-jpj4-qcrr
References
Other 10
- https://github.com/grpc/grpc/pull/33667
- https://github.com/grpc/grpc/pull/33669
- https://github.com/grpc/grpc/pull/33670
- https://github.com/grpc/grpc/pull/33672
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/grpc/CVE-2023-4785.yml
- https://groups.google.com/g/grpc-io/c/LlLkB1CeE4U
- https://rubygems.org/gems/grpc/versions/1.53.2
- https://rubygems.org/gems/grpc/versions/1.54.3
- https://rubygems.org/gems/grpc/versions/1.55.3
- https://rubygems.org/gems/grpc/versions/1.56.2
More Google vulnerabilities
- TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
- TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
Sources
- CVE-2023-4785 · CVE Program
- CVE-2023-4785 · NVD
- FIRST EPSS
- GHSA-p25m-jpj4-qcrr · GitHub Advisory Database · CC BY 4.0
- CVE-2023-4785 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences