Information leak in gRPC

CVE-2023-32731

Summary

A desynchronization vulnerability in gRPC's HTTP2 stack arises when a header size exceeds the allowable limits, causing the system to skip parsing the remainder of the HPACK frame. This results in mutations to the HPACK table going unprocessed, which can affect communication between a proxy and backend systems. As a consequence, requests made by the proxy might be mistakenly interpreted as originating from different clients, leading to potential information leaks. Exploitation of this vulnerability can facilitate privilege escalation or permit unauthorized data exfiltration, making it imperative for users to upgrade their systems to versions beyond the corrective commit.

References