Read the docs
TI-2024-06711 Aliases CVE-2024-7246GHSA-ghwg-gpp4-w4x3

HPACK table poisoning in gRPC C++, Python & Ruby

Priority LOW 27CWE-440Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GooglegRPC1.53.0; 1.53.1; 1.53.2; 1.54.0; 1.54.1; 1.54.3; 1.55.0; 1.55.1; 1.55.3; 1.55.4; 1.56.0; 1.56.1; 1.56.2; 1.56.3; 1.56.4; 1.57.0; 1.57.1; 1.58.0; 1.58.1; 1.58.2; 1.59.0; 1.59.1; 1.59.2; 1.59.3; 1.59.4; 1.60.0; 1.60.1; 1.61.0; 1.61.1; 1.62.0; 1.61.2; 1.62.1; 1.62.2; 1.63.0; 1.63.1; 1.64.0; 1.64.1; 1.64.2; 1.65.0; 1.65.1; 1.65.2; 1.65.3—No fix listedCNA
  • gRPC VendorGoogle Affected 1.53.0; 1.53.1; 1.53.2; 1.54.0; 1.54.1; 1.54.3; 1.55.0; 1.55.1; 1.55.3; 1.55.4; 1.56.0; 1.56.1; 1.56.2; 1.56.3; 1.56.4; 1.57.0; 1.57.1; 1.58.0; 1.58.1; 1.58.2; 1.59.0; 1.59.1; 1.59.2; 1.59.3; 1.59.4; 1.60.0; 1.60.1; 1.61.0; 1.61.1; 1.62.0; 1.61.2; 1.62.1; 1.62.2; 1.63.0; 1.63.1; 1.64.0; 1.64.1; 1.64.2; 1.65.0; 1.65.1; 1.65.2; 1.65.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*before 1.58.3; 1.59.0 to before 1.59.5; 1.60.0 to before 1.60.2; 1.61.0 to before 1.61.3; 1.62.0 to before 1.62.3; 1.63.0 to before 1.63.2; 1.64.0 to before 1.64.3; 1.65.0 to before 1.65.4Vulnerablegrpc
  • cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:* Versions before 1.58.3; 1.59.0 to before 1.59.5; 1.60.0 to before 1.60.2; 1.61.0 to before 1.61.3; 1.62.0 to before 1.62.3; 1.63.0 to before 1.63.2; 1.64.0 to before 1.64.3; 1.65.0 to before 1.65.4 Vulnerable ·grpc

Remediation

Red Hat 3 advisories

  • RHSA-2025:1335 Released 2025-02-12 · Red Hat rating Important
    RHUI 4.11 security, bugfix, and enhancement update
    • RHUI 4 for RHEL 8 python-aiohttp-3.9.4-1.el8ui, python-cryptography-42.0.8-1.el8ui, python-django-4.2.15-1.el8ui +13
  • RHSA-2024:8906 Released 2024-11-05 · Red Hat rating Critical
    Satellite 6.16.0 release
    • Red Hat Satellite 6.16 for RHEL 8 ansible-collection-redhat-satellite-4.2.0-1.el8sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el8sat, ansible-lint-5.4.0-1.el8pc +47
    • Red Hat Satellite 6.16 for RHEL 9 ansible-collection-redhat-satellite-4.2.0-1.el9sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el9sat, ansible-runner-2.2.1-5.el9pc +47
  • RHSA-2024:6428 Released 2024-09-05 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-4.5.10-1.el8ap, automation-controller-cli-4.5.10-1.el8ap, automation-controller-server-4.5.10-1.el8ap +7
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-4.5.10-1.el9ap, automation-controller-cli-4.5.10-1.el9ap, automation-controller-server-4.5.10-1.el9ap +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
RHUI 4 for RHEL 8Fixed RHSA-2025:1335
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2024:6428
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2024:6428
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2024:8906
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2024:8906
Not affected: 60 products
  • Builds for Red Hat OpenShift
  • Cryostat 3
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Kube Descheduler Operator
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Migration Toolkit for Applications 7
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • Multiarch Tuning Operator
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • OpenShift API for Data Protection
  • OpenShift Developer Tools and Services
  • OpenShift Pipelines
  • OpenShift Run Once Duration Override Operator
  • OpenShift Secondary Scheduler Operator
  • OpenShift Serverless
  • OpenShift Service Mesh 2
  • RHUI 4 for RHEL 8
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Ceph Storage 5
  • Red Hat Ceph Storage 6
  • Red Hat Ceph Storage 7
  • Red Hat Connectivity Link 1
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Cluster Manager CLI
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform Assisted Installer 1
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Openshift Container Storage 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Sandboxed Containers
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Service Interconnect 1
  • Red Hat Storage 3
  • Red Hat Trusted Application Pipeline
  • Self Node Remediation Operator
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7246
  2. 2026-10-03 Alias added: GHSA-ghwg-gpp4-w4x3
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences