CVE-2023-4785

Denial of Service in gRPC Core

HIGH

7.5

CVSS Score

Published: September 13, 2023 at 04:31 PM UTC

Updated: June 17, 2026 at 06:38 AM UTC

1 product affected across 1 vendorGrpc

Using gRPC by Google?

Get instant alerts when new vulnerabilities affect gRPC - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Grpc · Grpcnpm

95%

v < 1.231.23.0 ≤ v < 1.53.21.53.0 ≤ v ≤ 1.53.11.54.0 ≤ v ≤ 1.54.21.54.0 ≤ v < 1.54.31.55.0 ≤ v ≤ 1.55.21.55.0 ≤ v ≤ 155.21.55.0 ≤ v < 1.55.31.56.0 ≤ v ≤ 1.56.11.53.0 1.54.0 1.55.0 1.56.0

Vendor states this is fixed in 1.23 (unaffected)

Affected range stops below 1.53.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.54.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.55.3, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 1.57 (unaffected)