CVE-2023-32732: gRPC connection termination issue
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.04362%
CWE
Published
7/6/2023
Updated
2/13/2025
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
io.grpc:grpc-protobuf | maven | < 1.53.0 | 1.53.0 |
grpcio | pip | < 1.53.0 | 1.53.0 |
grpc | rubygems | < 1.53.0 | 1.53.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from missing null checks in header processing functions. The patch adds Preconditions.checkNotNull()
to various toBytes
/toStream
methods in Metadata
's inner classes. These functions process
'-bin' suffixed headers and convert values using marshallers. Without null checks, invalid base64 inputs would cause NPEs during header serialization, terminating connections. The vulnerable functions are the original implementations that directly returned marshaller results without validation, as evidenced by the added null checks in the patch. All modified functions handle header value conversion and would appear in stack traces when processing malicious headers.