What’s Vulnerable › Products

Google gRPC vulnerabilities

18 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Google gRPC version is affected

Exploited Google gRPC vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability

Latest Google gRPC vulnerabilities

• CVE-2026-84445 — gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers (CVSS 8.7)
• CVE-2026-84304 — gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation (CVSS 8.7)
• CVE-2026-84303 — gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion (CVSS 6.3)
• CVE-2026-33186 — gRPC-Go has an authorization bypass via missing leading slash in :path (CVSS 9.1)
• CVE-2024-11407 — Denial of Service through Data corruption in gRPC-C++ (CVSS 7.5)
• CVE-2024-7246 — HPACK table poisoning in gRPC C++, Python & Ruby (CVSS 5.3)
• CVE-2024-37168 — @grpc/grpc-js can allocate memory for incoming messages well above configured limits (CVSS 5.3)
• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
• CVE-2023-4785 — Denial of Service in gRPC Core (CVSS 7.5)
• CVE-2023-33953 — Denial-of-Service in gRPC (CVSS 7.5)
• CVE-2023-32732 — Denial-of-Service in gRPC (CVSS 5.3)
• CVE-2023-32731 — Information leak in gRPC (CVSS 7.5)
• CVE-2023-1428 — Denial-of-Service in gRPC (CVSS 7.5)
• CVE-2020-7768 — Prototype Pollution (CVSS 9.8)
• CVE-2017-9431 — (CVSS 9.8)
• CVE-2017-8359 — (CVSS 9.8)
• CVE-2017-7861 — (CVSS 9.8)
• CVE-2017-7860 — (CVSS 9.8)