CVE-2023-4785

Published: Sep 13, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

Affected (4)

Products: Grpc: Grpc

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Grpc Grpc	From 1.23.0 to 1.53.2
Grpc Grpc	From 1.54.0 to 1.54.3
Grpc Grpc	From 1.55.0 to 1.55.3
Grpc Grpc	Version 1.56.0

Related CWEs

Uncaught Exception

An exception is thrown from a function, but it is not caught.

References (10)

https://github.com/grpc/grpc/pull/33656

Source: cve-coordination@google.com

Issue TrackingPatch

https://github.com/grpc/grpc/pull/33667

Source: cve-coordination@google.com

Issue Tracking

https://github.com/grpc/grpc/pull/33669

Source: cve-coordination@google.com

Issue Tracking

https://github.com/grpc/grpc/pull/33670

Source: cve-coordination@google.com

Issue Tracking

https://github.com/grpc/grpc/pull/33672

Source: cve-coordination@google.com

Issue Tracking

https://github.com/grpc/grpc/pull/33656

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://github.com/grpc/grpc/pull/33667

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://github.com/grpc/grpc/pull/33669

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://github.com/grpc/grpc/pull/33670

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://github.com/grpc/grpc/pull/33672

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

Timeline

No history available yet.