CVE catalog
CVE-2023-32731
grpc: CVE-2023-32731
- Severity
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.50% · Oct 25, 2026
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | grpc | sid | 1.51.1-10 | not affected |
| Debian | grpc | forky | 1.51.1-10 | not affected |
| Debian | grpc | trixie | 1.51.1-6 | not affected |
| Debian | grpc | bookworm | 1.51.1-3 | not affected |
| Opensuse | python-grpcio | tumbleweed | 1.84.0-1.1 | fixed |
| Suse | abseil-cpp | linux enterprise installer updates 15 sp4 | 20230802.1-150400.10.4.1 | fixed |
| Suse | protobuf | linux enterprise installer updates 15 sp4 | 25.1-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise installer updates 15 sp5 | 20230802.1-150400.10.4.1 | fixed |
| Suse | protobuf | linux enterprise installer updates 15 sp5 | 25.1-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise micro 5.3 | 20230802.1-150400.10.4.1 | fixed |
| Suse | protobuf | linux enterprise micro 5.3 | 25.1-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise micro 5.4 | 20230802.1-150400.10.4.1 | fixed |
| Suse | protobuf | linux enterprise micro 5.4 | 25.1-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise micro 5.5 | 20230802.1-150400.10.4.1 | fixed |
| Suse | protobuf | linux enterprise micro 5.5 | 25.1-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise module for basesystem 15 sp5 | 20230802.1-150400.10.4.1 | fixed |
| Suse | grpc | linux enterprise module for basesystem 15 sp5 | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | linux enterprise module for basesystem 15 sp5 | 25.1-150400.9.3.1 | fixed |
| Suse | re2 | linux enterprise module for basesystem 15 sp5 | 20240201-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise module for development tools 15 sp5 | 20230802.1-150400.10.4.1 | fixed |
| Suse | protobuf | linux enterprise module for development tools 15 sp5 | 25.1-150400.9.3.1 | fixed |
| Suse | protobuf | linux enterprise module for package hub 15 sp5 | 25.1-150400.9.3.1 | fixed |
| Suse | grpc | linux enterprise module for public cloud 15 sp4 | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | linux enterprise module for public cloud 15 sp4 | 25.1-150400.9.3.1 | fixed |
| Suse | grpc | linux enterprise module for public cloud 15 sp5 | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | linux enterprise module for public cloud 15 sp5 | 25.1-150400.9.3.1 | fixed |
| Suse | re2 | linux enterprise module for public cloud 15 sp5 | 20240201-150400.9.3.1 | fixed |
| Suse | protobuf | linux enterprise module for python 3 15 sp5 | 25.1-150400.9.3.1 | fixed |
| Suse | python-abseil | linux enterprise module for python 3 15 sp5 | 1.4.0-150400.9.3.1 | fixed |
| Suse | python-grpcio | linux enterprise module for python 3 15 sp5 | 1.60.0-150400.9.3.2 | fixed |
| Suse | abseil-cpp | linux enterprise high performance computing 15 sp4-espos | 20230802.1-150400.10.4.1 | fixed |
| Suse | grpc | linux enterprise high performance computing 15 sp4-espos | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | linux enterprise high performance computing 15 sp4-espos | 25.1-150400.9.3.1 | fixed |
| Suse | re2 | linux enterprise high performance computing 15 sp4-espos | 20240201-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise high performance computing 15 sp4-ltss | 20230802.1-150400.10.4.1 | fixed |
| Suse | grpc | linux enterprise high performance computing 15 sp4-ltss | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | linux enterprise high performance computing 15 sp4-ltss | 25.1-150400.9.3.1 | fixed |
| Suse | re2 | linux enterprise high performance computing 15 sp4-ltss | 20240201-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise server 15 sp4-ltss | 20230802.1-150400.10.4.1 | fixed |
| Suse | grpc | linux enterprise server 15 sp4-ltss | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | linux enterprise server 15 sp4-ltss | 25.1-150400.9.3.1 | fixed |
| Suse | re2 | linux enterprise server 15 sp4-ltss | 20240201-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise server for sap applications 15 sp4 | 20230802.1-150400.10.4.1 | fixed |
| Suse | grpc | linux enterprise server for sap applications 15 sp4 | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | linux enterprise server for sap applications 15 sp4 | 25.1-150400.9.3.1 | fixed |
| Suse | re2 | linux enterprise server for sap applications 15 sp4 | 20240201-150400.9.3.1 | fixed |
| Suse | abseil-cpp | manager proxy 4.3 | 20230802.1-150400.10.4.1 | fixed |
| Suse | grpc | manager proxy 4.3 | 1.60.0-150400.8.3.2 | fixed |
| Suse | protobuf | manager proxy 4.3 | 25.1-150400.9.3.1 | fixed |
| Suse | re2 | manager proxy 4.3 | 20240201-150400.9.3.1 | fixed |
| Suse | abseil-cpp | linux enterprise workstation extension 15 sp5 | 20230802.1-150400.10.4.1 | fixed |
| Opensuse | abseil-cpp | leap micro 5.3 | 20230802.1-150400.10.4.1 | fixed |
| Opensuse | protobuf | leap micro 5.3 | 25.1-150400.9.3.1 | fixed |
| Opensuse | abseil-cpp | leap micro 5.4 | 20230802.1-150400.10.4.1 | fixed |
| Opensuse | protobuf | leap micro 5.4 | 25.1-150400.9.3.1 | fixed |
| Opensuse | abseil-cpp | leap 15.5 | 20230802.1-150400.10.4.1 | fixed |
| Opensuse | grpc | leap 15.5 | 1.60.0-150400.8.3.2 | fixed |
| Opensuse | opencensus-proto | leap 15.5 | 0.3.0+git.20200721-150400.9.3.1 | fixed |
| Opensuse | protobuf | leap 15.5 | 25.1-150400.9.3.1 | fixed |
| Opensuse | python-abseil | leap 15.5 | 1.4.0-150400.9.3.1 | fixed |
| Opensuse | python-grpcio | leap 15.5 | 1.60.0-150400.9.3.2 | fixed |
| Opensuse | re2 | leap 15.5 | 20240201-150400.9.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | grpc | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | grpc | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | grpc | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | grpc | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Opensuse | python-grpcio | rpm | tumbleweed | 1.84.0-1.1 | Not reported | OPENSUSE-SU-2026:11926-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise installer updates 15 sp4 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise installer updates 15 sp4 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise installer updates 15 sp5 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise installer updates 15 sp5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise micro 5.3 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise micro 5.3 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise micro 5.4 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise micro 5.4 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise micro 5.5 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise micro 5.5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise module for basesystem 15 sp5 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | linux enterprise module for basesystem 15 sp5 | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise module for basesystem 15 sp5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | re2 | rpm | linux enterprise module for basesystem 15 sp5 | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise module for development tools 15 sp5 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise module for development tools 15 sp5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise module for package hub 15 sp5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | linux enterprise module for public cloud 15 sp4 | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise module for public cloud 15 sp4 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | linux enterprise module for public cloud 15 sp5 | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise module for public cloud 15 sp5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | re2 | rpm | linux enterprise module for public cloud 15 sp5 | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise module for python 3 15 sp5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | python-abseil | rpm | linux enterprise module for python 3 15 sp5 | 1.4.0-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | python-grpcio | rpm | linux enterprise module for python 3 15 sp5 | 1.60.0-150400.9.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise high performance computing 15 sp4-espos | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | linux enterprise high performance computing 15 sp4-espos | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise high performance computing 15 sp4-espos | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | re2 | rpm | linux enterprise high performance computing 15 sp4-espos | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise high performance computing 15 sp4-ltss | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | linux enterprise high performance computing 15 sp4-ltss | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise high performance computing 15 sp4-ltss | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | re2 | rpm | linux enterprise high performance computing 15 sp4-ltss | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise server 15 sp4-ltss | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | linux enterprise server 15 sp4-ltss | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise server 15 sp4-ltss | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | re2 | rpm | linux enterprise server 15 sp4-ltss | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise server for sap applications 15 sp4 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | linux enterprise server for sap applications 15 sp4 | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | linux enterprise server for sap applications 15 sp4 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | re2 | rpm | linux enterprise server for sap applications 15 sp4 | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | manager proxy 4.3 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | grpc | rpm | manager proxy 4.3 | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | protobuf | rpm | manager proxy 4.3 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | re2 | rpm | manager proxy 4.3 | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Suse | abseil-cpp | rpm | linux enterprise workstation extension 15 sp5 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | abseil-cpp | rpm | leap micro 5.3 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | protobuf | rpm | leap micro 5.3 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | abseil-cpp | rpm | leap micro 5.4 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | protobuf | rpm | leap micro 5.4 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | abseil-cpp | rpm | leap 15.5 | 20230802.1-150400.10.4.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | grpc | rpm | leap 15.5 | 1.60.0-150400.8.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | opencensus-proto | rpm | leap 15.5 | 0.3.0+git.20200721-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | protobuf | rpm | leap 15.5 | 25.1-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | python-abseil | rpm | leap 15.5 | 1.4.0-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | python-grpcio | rpm | leap 15.5 | 1.60.0-150400.9.3.2 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
| Opensuse | re2 | rpm | leap 15.5 | 20240201-150400.9.3.1 | Not reported | SUSE-SU-2024:0573-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13621-1.json]
- [https://osv.dev/vulnerability/SUSE-SU-2024:0573-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11926-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-32731]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-32731.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]