Read the docs
TI-2023-16822 Aliases CVE-2023-33953GHSA-496j-2rq6-j6cc

Denial-of-Service in gRPC

Priority LOW 39CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-789.

Summary

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Fix Fixed gRPC (Google): 1.56.1grpcio (PyPI): 1.53.2, 1.54.3, 1.55.2 +1+1 more productRed Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GooglegRPCbefore 1.56.11.56.1Patch availableCNA
—grpcio (PyPI)before 1.53.21.53.2Patch availableGHSA-496j-2rq6-j6cc
—grpcio (PyPI)1.54.0 to before 1.54.31.54.3Patch availableGHSA-496j-2rq6-j6cc
—grpcio (PyPI)1.55.0 to before 1.55.21.55.2Patch availableGHSA-496j-2rq6-j6cc
—grpcio (PyPI)1.56.0 to before 1.56.21.56.2Patch availableGHSA-496j-2rq6-j6cc
—grpc (RubyGems)before 1.53.21.53.2Patch availableGHSA-496j-2rq6-j6cc
—grpc (RubyGems)1.54.0 to before 1.54.31.54.3Patch availableGHSA-496j-2rq6-j6cc
—grpc (RubyGems)1.55.0 to before 1.55.21.55.2Patch availableGHSA-496j-2rq6-j6cc
—grpc (RubyGems)1.56.0 to before 1.56.21.56.2Patch availableGHSA-496j-2rq6-j6cc
  • gRPC VendorGoogle Affected before 1.56.1 Fixed in 1.56.1 Patch available CNA
  • grpcio (PyPI) Vendor— Affected before 1.53.2 Fixed in 1.53.2 Patch available GHSA-496j-2rq6-j6cc
  • grpcio (PyPI) Vendor— Affected 1.54.0 to before 1.54.3 Fixed in 1.54.3 Patch available GHSA-496j-2rq6-j6cc
  • grpcio (PyPI) Vendor— Affected 1.55.0 to before 1.55.2 Fixed in 1.55.2 Patch available GHSA-496j-2rq6-j6cc
  • grpcio (PyPI) Vendor— Affected 1.56.0 to before 1.56.2 Fixed in 1.56.2 Patch available GHSA-496j-2rq6-j6cc
  • grpc (RubyGems) Vendor— Affected before 1.53.2 Fixed in 1.53.2 Patch available GHSA-496j-2rq6-j6cc
  • grpc (RubyGems) Vendor— Affected 1.54.0 to before 1.54.3 Fixed in 1.54.3 Patch available GHSA-496j-2rq6-j6cc
  • grpc (RubyGems) Vendor— Affected 1.55.0 to before 1.55.2 Fixed in 1.55.2 Patch available GHSA-496j-2rq6-j6cc
  • grpc (RubyGems) Vendor— Affected 1.56.0 to before 1.56.2 Fixed in 1.56.2 Patch available GHSA-496j-2rq6-j6cc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*before 1.53.2; 1.54.0 to before 1.54.3; 1.55.0 to before 1.55.2; 1.56.0 to before 1.56.2Vulnerablegrpc
  • cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:* Versions before 1.53.2; 1.54.0 to before 1.54.3; 1.55.0 to before 1.55.2; 1.56.0 to before 1.56.2 Vulnerable ·grpc

Remediation

  • Fix · CNA gRPC (Google) Fixed in 1.56.1
  • Fix · GHSA-496j-2rq6-j6cc grpcio (PyPI) Fixed in 1.53.2 Advisory →
  • Fix · GHSA-496j-2rq6-j6cc grpcio (PyPI) Fixed in 1.54.3 Advisory →
  • Fix · GHSA-496j-2rq6-j6cc grpcio (PyPI) Fixed in 1.55.2 Advisory →
  • Fix · GHSA-496j-2rq6-j6cc grpcio (PyPI) Fixed in 1.56.2 Advisory →
  • Fix · GHSA-496j-2rq6-j6cc grpc (RubyGems) Fixed in 1.53.2 Advisory →
  • Fix · GHSA-496j-2rq6-j6cc grpc (RubyGems) Fixed in 1.54.3 Advisory →
  • Fix · GHSA-496j-2rq6-j6cc grpc (RubyGems) Fixed in 1.55.2 Advisory →
  • Fix · GHSA-496j-2rq6-j6cc grpc (RubyGems) Fixed in 1.56.2 Advisory →

Red Hat 1 advisory

  • RHSA-2024:10761 Released 2024-12-03 · Red Hat rating Important
    rhc-worker-playbook security update
    • Red Hat Enterprise Linux AppStream (v. 9) rhc-worker-playbook-0.1.10-1.el9_5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:10761
Not affected: 50 products
  • Builds for Red Hat OpenShift
  • Cryostat 3
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Kube Descheduler Operator
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Migration Toolkit for Applications 7
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • Multiarch Tuning Operator
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • OpenShift API for Data Protection
  • OpenShift Developer Tools and Services
  • OpenShift Run Once Duration Override Operator
  • OpenShift Secondary Scheduler Operator
  • OpenShift Serverless
  • OpenShift Service Mesh 2
  • OpenShift Source-to-Image (S2I)
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ceph Storage 5
  • Red Hat Ceph Storage 6
  • Red Hat Ceph Storage 7
  • Red Hat Connectivity Link 1
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Cluster Manager CLI
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform Assisted Installer 1
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Openshift Container Storage 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Sandboxed Containers
  • Red Hat Satellite 6
  • Red Hat Service Interconnect 1
  • Red Hat Storage 3
  • Self Node Remediation Operator
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-33953
  2. 2026-10-03 Alias added: GHSA-496j-2rq6-j6cc
  3. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 3

Other 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences