CVE-2023-33953

CVE-2023-33953 is a high-severity allocation of resources without limits or throttling vulnerability in grpcio (pip), affecting versions < 1.53.2. It is fixed in 1.53.2, 1.54.3, 1.55.2, 1.56.2.

Summary

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:

  • Unbounded memory buffering in the HPACK parser
  • Unbounded CPU consumption in the HPACK parser

The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.

The unbounded memory buffering bugs:

  • The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb.
  • HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse.
  • gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…

Impact

The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.

CVE-2023-33953 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.53.2, 1.54.3, 1.55.2, 1.56.2); upgrading removes the vulnerable code path.

Affected versions

grpcio (< 1.53.2) grpcio (>= 1.54.0, < 1.54.3) grpcio (>= 1.55.0, < 1.55.2) grpcio (>= 1.56.0, < 1.56.2) grpc (< 1.53.2) grpc (>= 1.54.0, < 1.54.3) grpc (>= 1.55.0, < 1.55.2) grpc (>= 1.56.0, < 1.56.2)

Security releases

grpcio → 1.53.2 (pip) grpcio → 1.54.3 (pip) grpcio → 1.55.2 (pip) grpcio → 1.56.2 (pip) grpc → 1.53.2 (rubygems) grpc → 1.54.3 (rubygems) grpc → 1.55.2 (rubygems) grpc → 1.56.2 (rubygems)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

See it in your environment

Remediation advice

Upgrade the following packages to resolve this vulnerability:

grpcio to 1.53.2 or later; grpcio to 1.54.3 or later; grpcio to 1.55.2 or later; grpcio to 1.56.2 or later; grpc to 1.53.2 or later; grpc to 1.54.3 or later; grpc to 1.55.2 or later; grpc to 1.56.2 or later

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

  1. What is CVE-2023-33953? CVE-2023-33953 is a high-severity allocation of resources without limits or throttling vulnerability in grpcio (pip), affecting versions < 1.53.2. It is fixed in 1.53.2, 1.54.3, 1.55.2, 1.56.2. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
  2. How severe is CVE-2023-33953? CVE-2023-33953 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
  3. Which packages are affected by CVE-2023-33953?
    • grpcio (pip) (versions < 1.53.2)
    • grpc (rubygems) (versions < 1.53.2)
  4. Is there a fix for CVE-2023-33953? Yes. CVE-2023-33953 is fixed in 1.53.2, 1.54.3, 1.55.2, 1.56.2. Upgrade to this version or later.
  5. Is CVE-2023-33953 exploitable, and should I be worried? Whether CVE-2023-33953 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  6. What actually determines whether CVE-2023-33953 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  7. How do I fix CVE-2023-33953?
    • Upgrade grpcio to 1.53.2 or later
    • Upgrade grpcio to 1.54.3 or later
    • Upgrade grpcio to 1.55.2 or later
    • Upgrade grpcio to 1.56.2 or later
    • Upgrade grpc to 1.53.2 or later
    • Upgrade grpc to 1.54.3 or later
    • Upgrade grpc to 1.55.2 or later
    • Upgrade grpc to 1.56.2 or later

Other vulnerabilities in grpcio

CVE-2023-4785CVE-2023-32732CVE-2023-1428CVE-2023-32731

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo