CVE catalog

CVE-2024-11407

grpc: CVE-2024-11407

Severity: Medium · CVSS 5.8CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H
Published: Nov 26, 2024, 4:59:49 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.58% · Oct 25, 2026

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	grpc	sid	`1.51.1-10`	vulnerable
Debian	grpc	forky	`1.51.1-10`	vulnerable
Debian	grpc	trixie	`1.51.1-6`	not affected
Debian	grpc	bookworm	`1.51.1-3`	not affected
Suse	python-grpcio	linux enterprise module for public cloud 15 sp6	`1.60.1-150600.16.8.1`	fixed
Opensuse	python-grpcio	leap 15.6	`1.60.1-150600.16.8.1`	fixed
Suse	grpc	linux enterprise module for basesystem 15 sp5	`1.60.0-150500.11.8.1`	fixed
Suse	grpc	linux enterprise module for public cloud 15 sp5	`1.60.0-150500.11.8.1`	fixed
Opensuse	grpc	leap 15.5	`1.60.0-150500.11.8.1`	fixed
Suse	grpc	linux enterprise module for public cloud 15 sp4	`1.60.0-150400.8.8.1`	fixed
Suse	python-grpcio	linux enterprise module for public cloud 15 sp4	`1.60.1-150400.9.10.1`	fixed
Opensuse	python-grpcio	tumbleweed	`1.69.0-2.1`	fixed
Suse	grpc	linux enterprise module for basesystem 15 sp6	`1.60.0-150600.15.3.1`	fixed
Opensuse	grpc	leap 15.6	`1.60.0-150600.15.3.1`	fixed
Suse	python-grpcio	linux enterprise module for public cloud 15 sp5	`1.60.1-150500.12.6.1`	fixed
Suse	python-grpcio	linux enterprise module for python 3 15 sp5	`1.60.1-150500.12.6.1`	fixed
Opensuse	python-grpcio	leap 15.5	`1.60.1-150500.12.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	grpc	source	sid	`(unfixed)`	not yet assigned	Not reported	[1088806]
Debian	grpc	source	forky	`(unfixed)`	not yet assigned	Not reported	[1088806]
Debian	grpc	source	trixie	`Not affected`	unimportant	Not reported	[1088806]
Debian	grpc	source	bookworm	`Not affected`	unimportant	Not reported	[1088806]
Suse	python-grpcio	rpm	linux enterprise module for public cloud 15 sp6	`1.60.1-150600.16.8.1`	Not reported	SUSE-SU-2024:4393-1	Not reported
Opensuse	python-grpcio	rpm	leap 15.6	`1.60.1-150600.16.8.1`	Not reported	SUSE-SU-2024:4393-1	Not reported
Suse	grpc	rpm	linux enterprise module for basesystem 15 sp5	`1.60.0-150500.11.8.1`	Not reported	SUSE-SU-2024:4436-1	Not reported
Suse	grpc	rpm	linux enterprise module for public cloud 15 sp5	`1.60.0-150500.11.8.1`	Not reported	SUSE-SU-2024:4436-1	Not reported
Opensuse	grpc	rpm	leap 15.5	`1.60.0-150500.11.8.1`	Not reported	SUSE-SU-2024:4436-1	Not reported
Suse	grpc	rpm	linux enterprise module for public cloud 15 sp4	`1.60.0-150400.8.8.1`	Not reported	SUSE-SU-2024:4400-1	Not reported
Suse	python-grpcio	rpm	linux enterprise module for public cloud 15 sp4	`1.60.1-150400.9.10.1`	Not reported	SUSE-SU-2024:4428-1	Not reported
Opensuse	python-grpcio	rpm	tumbleweed	`1.69.0-2.1`	Not reported	OPENSUSE-SU-2025:15031-1	Not reported
Suse	grpc	rpm	linux enterprise module for basesystem 15 sp6	`1.60.0-150600.15.3.1`	Not reported	SUSE-SU-2024:4401-1	Not reported
Opensuse	grpc	rpm	leap 15.6	`1.60.0-150600.15.3.1`	Not reported	SUSE-SU-2024:4401-1	Not reported
Suse	python-grpcio	rpm	linux enterprise module for public cloud 15 sp5	`1.60.1-150500.12.6.1`	Not reported	SUSE-SU-2024:4429-1	Not reported
Suse	python-grpcio	rpm	linux enterprise module for python 3 15 sp5	`1.60.1-150500.12.6.1`	Not reported	SUSE-SU-2024:4429-1	Not reported
Opensuse	python-grpcio	rpm	leap 15.5	`1.60.1-150500.12.6.1`	Not reported	SUSE-SU-2024:4429-1	Not reported

[Debian bug #1088806]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libgrpc++1.51]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3+b1 · amd64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3+b1 · arm64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
[libgrpc29]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3+b1 · amd64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3+b1 · arm64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
[libgrpc++-dev]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3+b1 · amd64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3+b1 · arm64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
[libgrpc-dev]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3+b1 · amd64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3+b1 · arm64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
[protobuf-compiler-grpc]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3+b1 · amd64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3+b1 · arm64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
[python3-grpcio]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3+b1 · amd64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3+b1 · arm64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
[ruby-grpc]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3+b1 · amd64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3+b1 · arm64 · bookworm
  Affected
  dsa · grpc · debian · bookworm
[ruby-grpc-tools]Affected
Source package: [grpc]
Details (2)
- 1.51.1-3 · all · bookworm
  Affected
  dsa · grpc · debian · bookworm
- 1.51.1-3 · all · bookworm
  Affected
  dsa · grpc · debian · bookworm

[openSUSE Tumbleweed]

[python313-grpcio]Unknown
Source package: [python-grpcio]
Details (1)
- 1.81.1-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 1.69.0-2.1
  Version impact unknown
  dsa · python-grpcio · opensuse · tumbleweed
[python314-grpcio]Unknown
Source package: [python-grpcio]
Details (1)
- 1.81.1-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 1.69.0-2.1
  Version impact unknown
  dsa · python-grpcio · opensuse · tumbleweed

Observed: Oct 27, 2026, 12:36:32 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]