Vendor
24 known vulnerabilities in products by Google, 1 of them actively exploited (CISA KEV).
Key figures
24
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEValso in 160 other products | 7.5 | |
| Critical | CVE-2026-33186 | gRPC-Go has an authorization bypass via missing leading slash in :path | 9.1 | |
| Critical | CVE-2017-8359 | Google gRPC: Use-After-Free | 9.8 | |
| Critical | CVE-2017-7860 | Google gRPC: Heap-Based Buffer Overflow | 9.8 | |
| Critical | CVE-2017-7861 | Google gRPC: Out-of-Bounds Write | 9.8 | |
| Critical | CVE-2017-9431 | Google gRPC: Heap-Based Buffer Overflow | 9.8 | |
| Critical | CVE-2020-7768 | Prototype Pollution | 7.5 | |
| High | CVE-2026-84445 | Google Grpc-go: Improper Validation of Array Index | — | |
| High | CVE-2026-84304 | gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation | 4.4 | |
| High | CVE-2026-48068 | @grpc/grps-js: A malformed request can cause a server crash | 7.5 | |
| High | CVE-2026-48069 | @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash | 7.5 | |
| High | CVE-2022-24777 | Denial of Service via reachable assertion in grpc-swift | 7.5 | |
| High | CVE-2026-101916 | Google Grpc-node: Improper Certificate Validation | 7.4 | |
| High | CVE-2023-4785 | Denial of Service in gRPC Core | 7.5 | |
| Medium | CVE-2026-101914 | Google Grpc-node: Partial String Comparison | 6.5 | |
| High | CVE-2024-11407 | Denial of Service through Data corruption in gRPC-C++ | 7.5 | |
| Medium | CVE-2026-84303 | gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion | — | |
| High | CVE-2023-32731 | Information leak in gRPC | 7.4 | |
| High | CVE-2023-33953 | Denial-of-Service in gRPC | 7.5 | |
| Medium | CVE-2024-37168 | @grpc/grpc-js can allocate memory for incoming messages well above configured limits | 5.3 | |
| High | CVE-2023-1428 | Denial-of-Service in gRPC | 7.5 | |
| Low | CVE-2026-101915 | Google Grpc-node: Server-generated Error Message Containing Sensitive Information | 3.7 | |
| Medium | CVE-2023-32732 | Denial-of-Service in gRPC | 5.3 | |
| Medium | CVE-2024-7246 | HPACK table poisoning in gRPC C++, Python & Ruby | 5.3 |
Products
| Google gRPC | 14 | 1 |
| Grpc-node | 6 | 0 |
| Grpc-go | 4 | 0 |