Connection confusion in gRPC (CVE-2023-32731)

Why this deserves its current priority

CVSS is 7.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps io.grpc:grpc-protobuf (maven), io.grpc:grpc-protobuf (maven), grpcio (pypi), grpcio (pypi) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
io.grpc:grpc-protobufmaven	>=1.53.0 <1.53.1	1.53.1
io.grpc:grpc-protobufmaven	>=1.54.0 <1.54.2	1.54.2
grpciopypi	>=1.53.0 <1.53.1	1.53.1
grpciopypi	>=1.54.0 <1.54.2	1.54.2
grpcrubygems	>=1.53.0 <1.53.1	1.53.1
grpcrubygems	>=1.54.0 <1.54.2	1.54.2

Recommended response

Check inventory. Check lockfiles and deployed manifests for io.grpc:grpc-protobuf, io.grpc:grpc-protobuf, grpcio.
Review the reported fix. Update io.grpc:grpc-protobuf to 1.53.1; io.grpc:grpc-protobuf to 1.54.2; grpcio to 1.53.1; grpcio to 1.54.2; grpc to 1.53.1; grpc to 1.54.2 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 5, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Aug 8, 2026

Sources and claim methodology

Upstream source description

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.

Quoted source text, attributed separately from HOL analysis.