Detections
Analytics

SCA: security update for grpc, grpcio (GHSA-496j-2rq6-j6cc)

high Tenable Cloud Security Plugin ID 421594

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects
 between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS
 attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser
 The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because
 that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected
 by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string
 reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8
 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the
 start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s
 metadata overflow check was performed per frame, so that the following sequence of frames could cause
 infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3
 etc… (CVE-2023-33953)

See Also

https://github.com/advisories/GHSA-496j-2rq6-j6cc

Plugin Details

Severity: High

ID: 421594

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-33953

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/9/2023

Vulnerability Publication Date: 8/9/2023

Reference Information

CVE: CVE-2023-33953