Most recent entries from all

BELL-CVE-2024-7246

Affected: Alpaquita:23: grpc, Alpaquita:stream: grpc, BellSoft Hardened Containers:stream: grpc

certfr-2025-avi-0661 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0661

EUVD-2026-103115

fkie_cve-2024-7246

This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table.

Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.

GHSA-ghwg-gpp4-w4x3

Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.

msrc_CVE-2024-7246 — HPACK table poisoning in gRPC C++, Python & Ruby

msrc_CVE-2024-7246

OESA-2024-2064 — grpc security update

Affected: openEuler:24.03-LTS: grpc

gRPC is a modern open source high performance RPC framework that can run in any environment. It can efficiently connect services in and across data centers with pluggable support for load balancing, tracing, health checking and authentication. It is also applicable in last mile of distributed computing to connect devices, mobile applications and browsers to backend services. Security Fix(es): It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.(CVE-2024-7246)

openSUSE-SU-2025:15031-1 — python311-grpcio-1.69.0-2.1 on GA media

python311-grpcio-1.69.0-2.1 on GA media

RHSA-2024:6428 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp automation-controller: Gain access to the k8s API server via job execution with Container Group grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django python-jose: algorithm confusion with OpenSSH ECDSA keys and other key formats python-django: Potential denial-of-service in django.utils.html.urlize() python-django: Username enumeration through timing difference for users with unusable passwords python-django: Potential directory-traversal in django.core.files.storage.Storage.save() python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant() python-django: Memory exhaustion in django.utils.numberformat.floatformat() python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget python-django: Potential SQL injection in QuerySet.values() and values_list()

SUSE-SU-2024:4393-1 — Security update for python-grpcio

Security update for python-grpcio

UBUNTU-CVE-2024-7246

Affected: Ubuntu:16.04:LTS: grpc, Ubuntu:18.04:LTS: grpc, Ubuntu:20.04:LTS: grpc, Ubuntu:22.04:LTS: grpc, Ubuntu:24.04:LTS: grpc, Ubuntu:25.10: grpc, Ubuntu:26.04:LTS: grpc

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.