{
  "cveId": "CVE-2023-32732",
  "url": "https://patchblox.com/security/cve/CVE-2023-32732",
  "summary": "CVE-2023-32732 is fixed in 10 products on 1 platform, first by ALAS2023-2023-282, released August 3, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "grpc: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2023-4785:\n\tLack of e...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2023-4785:\n\tLack of error handling in the TCP server in Google\u0027s gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C\u002B\u002B Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.\n\nCVE-2023-32732:\n\tgRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for \u0060-bin\u0060 suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in  https://github.com/grpc/grpc/pull/32309 https://www.google.com/url\n\nCVE-2023-32731:\n\tWhen gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in  https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005",
  "published": "2023-08-03T20:26:00Z",
  "severity": "important",
  "epss": 0.00527,
  "epssPercentile": 0.44855,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "grpc",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-cpp",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-cpp-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-data",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-devel",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-doc",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-plugins",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    },
    {
      "platform": "linux",
      "product": "grpc-plugins-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.56.2-10.amzn2023",
      "fix": "ALAS2023-2023-282",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-282",
      "released": "2023-08-03T20:26:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}