CVE-2026-48069 | High | 7.5 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4… |
CVE-2026-48068 | High | 7.5 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4… |
CVE-2026-33186 | Critical | 9.1 | 2026-03-20 | gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2… |
CVE-2024-11407 | High | 7.5 | 2024-11-26 | There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX… |
CVE-2024-7246 | Medium | 5.3 | 2024-08-06 | It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see faile… |
CVE-2024-37168 | Medium | 5.3 | 2024-06-10 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-4785 | High | 7.5 | 2023-09-13 | Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial… |
CVE-2023-33953 | High | 7.5 | 2023-08-09 | gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Th… |
CVE-2023-32732 | Medium | 5.3 | 2023-06-09 | gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin… |
CVE-2023-32731 | High | 7.4 | 2023-06-09 | When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be ski… |
CVE-2023-1428 | High | 7.5 | 2023-06-09 | There exists an vulnerability causing an abort() to be called in gRPC.
The following headers cause gRPC's C++ implementation to abort() when called via http2… |
CVE-2022-24777 | High | 7.5 | 2022-03-25 | grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to… |
CVE-2020-7768 | High | 7.5 | 2020-11-11 | The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. |
CVE-2017-9431 | Critical | 9.8 | 2017-06-05 | Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c. |
CVE-2017-8359 | Critical | 9.8 | 2017-04-30 | Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/ca… |
CVE-2017-7861 | Critical | 9.8 | 2017-04-14 | Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c. |
CVE-2017-7860 | Critical | 9.8 | 2017-04-14 | Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/p… |