GR
Vendor
Grpc
26
CVEs
1
On KEV
0
New 30D
Products
GR9.8
Grpc
Grpc
15 CVEs1 on KEV0 new
GR7.5
grpc-node
grpc
6 CVEs0 on KEV0 new
GR9.1
grpc-go
grpc
4 CVEs0 on KEV0 new
GR7.5
gRPC-C++
grpc
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-101916 | GR grpc-node grpc | 7.4 | Sep 28 | @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized |
| CVE-2026-101915 | GR grpc-node grpc | 3.7 | Sep 28 | @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages |
| CVE-2026-101914 | GR grpc-node grpc | 6.5 | Sep 28 | @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches |
| CVE-2026-84445 | GR grpc-go grpc | 8.7 | Sep 14 | gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers |
| CVE-2026-84304 | GR grpc-go grpc | 8.7 | Sep 1 | gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation |
| CVE-2026-84303 | GR grpc-go grpc | 6.3 | Sep 1 | gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion |
| CVE-2026-48069 | GR grpc-node grpc | 7.5 | Jul 14 | @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash |
| CVE-2026-48068 | GR grpc-node grpc | 7.5 | Jul 14 | @grpc/grps-js: A malformed request can cause a server crash |
| CVE-2026-33186 | GR grpc-go grpc | 9.1 | Mar 20 | gRPC-Go has an authorization bypass via missing leading slash in :path |
| CVE-2024-11407 | GR gRPC-C++ grpc | 7.5 | Nov 26 | Denial of Service through Data corruption in gRPC-C++ |
| CVE-2024-7246 | GR Grpc Grpc | 5.3 | Aug 6 | HPACK table poisoning in gRPC C++, Python & Ruby |
| CVE-2024-37168 | GR grpc-node grpc | 5.3 | Jun 10 | @grpc/grpc-js can allocate memory for incoming messages well above configured limits |
| CVE-2023-44487 In wildKEV | GR Grpc Grpc | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability |
| CVE-2023-4785 | GR Grpc Grpc | 7.5 | Sep 13 | Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex |
| CVE-2023-33953 | GR Grpc Grpc | 7.5 | Aug 9 | gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were… |
| CVE-2023-32732 | GR Grpc Grpc | 5.3 | Jun 9 | gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers… |
| CVE-2023-32731 | GR Grpc Grpc | 7.5 | Jun 9 | When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame |
| CVE-2023-1428 | GR Grpc Grpc | 7.5 | Jun 9 | There exists an vulnerability causing an abort() to be called in gRPC. The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x !=… |
| CVE-2020-7768 | GR Grpc Grpc | 9.8 | Nov 11 | The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition |
| CVE-2017-9431 | GR Grpc Grpc | 9.8 | Jun 5 | Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c |
| CVE-2017-8359 | GR Grpc Grpc | 9.8 | Apr 30 | Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c |
| CVE-2017-7861 | GR Grpc Grpc | 9.8 | Apr 14 | Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c |
| CVE-2017-7860 | GR Grpc Grpc | 9.8 | Apr 14 | Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the parse_unix function in core/ext/client_channel/parse_address.c |