{"answers":{"affected":"7 open source packages ship an affected version, including grpcio, io.grpc:grpc-protobuf and grpc. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-1428 in the wild and no public exploit code.","fix":"Upgrade grpcio to 1.53.0 or later.","what":"CVE-2023-1428 is a high-severity denial of service vulnerability in Google gRPC, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-1428 and fix it if it is affected.\n\nWhat it is: CVE-2023-1428 is a high-severity denial of service vulnerability in Google gRPC, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-1428 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- grpcio (PyPI): affected from 1.51.0; fixed in 1.53.0\n- grpcio (PyPI): affected from 1.51.0; fixed in 1.53.0\n- grpcio (PyPI): affected from 1.51.0; fixed in 1.53.0\n- io.grpc:grpc-protobuf (Maven): affected from 1.51.0; fixed in 1.53.0\n- io.grpc:grpc-protobuf (Maven): affected from 1.51.0; fixed in 1.53.0\n- grpc (RubyGems): affected from 1.51.0; fixed in 1.53.0\n- grpc (RubyGems): affected from 1.51.0; fixed in 1.53.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-1428/ (Markdown: https://insights.sbomify.com/CVE-2023-1428/index.md)","id":"CVE-2023-1428","markdown":"https://insights.sbomify.com/CVE-2023-1428/index.md","name":"CVE-2023-1428","record":{"aliases":["BELL-CVE-2023-1428","CLEANSTART-2026-ER15983","GHSA-6628-q6j9-w8vg","PYSEC-2026-1425","UBUNTU-CVE-2023-1428"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"gRPC C++ library","requires_auth":"none","summary":"Attackers can cause a denial of service in gRPC C++ implementations by sending specific malformed HTTP/2 headers that trigger an abort.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Google","cpe":[{"product":"grpc","vendor":"grpc"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-617","name":"Reachable Assertion"}],"description":"There exists an vulnerability causing an abort() to be called in gRPC. \nThe following headers cause gRPC's C++ implementation to abort() when called via http2:\n\nte: x (x != trailers)\n\n:scheme: x (x != http, https)\n\ngrpclb_client_stats: x (x == anything)\n\nOn top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.","ecosystems":["Maven","PyPI","RubyGems"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Denial-of-Service in gRPC","id":"CVE-2023-1428","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"denial_of_service","year":"2023"},"n_packages":7,"n_references":1,"next":{"headline":"Cross-site Scripting (XSS) - Reflected in pimcore/pimcore","id":"CVE-2023-1429"},"packages":[{"ecosystem":"Maven","fixed":["1.53.0"],"introduced":["1.51.0"],"last_affected":[],"package":"io.grpc:grpc-protobuf","purl":null,"source":"GHSA-6628-q6j9-w8vg"},{"ecosystem":"Maven","fixed":["1.53.0"],"introduced":["1.51.0"],"last_affected":[],"package":"io.grpc:grpc-protobuf","purl":"pkg:maven/io.grpc/grpc-protobuf","source":"GHSA-6628-q6j9-w8vg"},{"ecosystem":"PyPI","fixed":["1.53.0"],"introduced":["1.51.0"],"last_affected":[],"package":"grpcio","purl":null,"source":"GHSA-6628-q6j9-w8vg"},{"ecosystem":"PyPI","fixed":["1.53.0"],"introduced":["1.51.0"],"last_affected":[],"package":"grpcio","purl":"pkg:pypi/grpcio","source":"GHSA-6628-q6j9-w8vg"},{"ecosystem":"PyPI","fixed":["1.53.0"],"introduced":["1.51.0"],"last_affected":[],"package":"grpcio","purl":"pkg:pypi/grpcio","source":"PYSEC-2026-1425"},{"ecosystem":"RubyGems","fixed":["1.53.0"],"introduced":["1.51.0"],"last_affected":[],"package":"grpc","purl":null,"source":"GHSA-6628-q6j9-w8vg"},{"ecosystem":"RubyGems","fixed":["1.53.0"],"introduced":["1.51.0"],"last_affected":[],"package":"grpc","purl":"pkg:gem/grpc","source":"GHSA-6628-q6j9-w8vg"}],"prev":{"headline":"Photo Gallery by 10Web \u003c 1.8.15 - Admin+ Path Traversal","id":"CVE-2023-1427"},"products":["gRPC"],"published":"2023-06-09","related":[{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2017-9431","kev_date_added":null,"published":"2017-06-05"},{"cvss_score":9.8,"headline":"Use after free in n/a","id":"CVE-2017-8359","kev_date_added":null,"published":"2017-04-30"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2017-7860","kev_date_added":null,"published":"2017-04-14"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2017-7861","kev_date_added":null,"published":"2017-04-14"},{"cvss_score":9.1,"headline":"gRPC-Go has an authorization bypass via missing leading slash in :path","id":"CVE-2026-33186","kev_date_added":null,"published":"2026-03-20"},{"cvss_score":7.5,"headline":"Denial of Service in gRPC Core","id":"CVE-2023-4785","kev_date_added":null,"published":"2023-09-13"},{"cvss_score":7.5,"headline":"Denial-of-Service in gRPC","id":"CVE-2023-33953","kev_date_added":null,"published":"2023-08-09"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-26","vendors":["Google"]},"summary":"Attackers can cause a denial of service in gRPC C++ implementations by sending specific malformed HTTP/2 headers that trigger an abort.","url":"https://insights.sbomify.com/CVE-2023-1428/"}