CVE-2024-7246

What it actually does

A gRPC client can send misencoded headers over HTTP/2 that are not cleared properly, poisoning the HPACK table shared between a proxy and backend; this causes subsequent incrementally indexed headers to trigger errors for other clients and allows leakage of HTTP header keys from other sessions.

Why it matters to the business

Clients experience unexpected request failures and limited exposure of header metadata, potentially disrupting service availability and reducing trust in shared proxy environments used by multiple tenants or services.

How an attack unfolds

An attacker acting as a gRPC client connects through an HTTP/2 proxy, crafts a request containing a header that triggers an error status without clearing it, poisons the HPACK table state, and observes or causes failed requests and header key leakage for other clients sharing the same connection path.

How to fix it

Upgrade gRPC to one of the fixed releases 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3 or 1.65.4; for affected fort-validator packages update to the commit 554c5fa738791173dbf8261d68b4515708fc70ce or Debian package version 1.6.3-1.

How to confirm the fix worked

Verify installed gRPC or fort-validator versions match or exceed the listed fixed releases; monitor HPACK table behavior under concurrent client loads with crafted headers to confirm error status clearing occurs between reads.

Typical attack path

1. Establish a gRPC-over-HTTP/2 connection via a proxy to the target backend
2. Send a specially crafted request with a misencoded header that leaves an uncleared error status
3. Trigger incremental header additions that become poisoned in the shared HPACK table
4. Observe failed requests or leaked header keys affecting other clients

How to detect it

Review proxy and gRPC server logs for clusters of header encoding errors followed by failed requests from unrelated clients; look for repeated connections from a single source that precede widespread request failures.

What your security team should do

• Prioritize upgrading all gRPC deployments to a fixed version immediately due to the published advisory
• Audit proxy and backend configurations for shared HTTP/2 connections that could amplify cross-client impact
• Implement header validation and error handling tests in CI pipelines to prevent regression