grpc - Debian Package Tracker

general

source: grpc (main)
version: 1.51.1-9
maintainer: Laszlo Boszormenyi (GCS) (DMD)
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.30.2-3
oldstable: 1.51.1-3
stable: 1.51.1-6
testing: 1.51.1-9
test-p-u: 1.51.1-9
unstable: 1.51.1-9
exp: 1.83.0-1

versioned links

1.30.2-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.51.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.51.1-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.51.1-9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.59.5-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.82.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.83.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libgrpc++-dev
libgrpc++1.51t64
libgrpc-dev (1 bugs: 0, 0, 1, 0)
libgrpc29t64
protobuf-compiler-grpc (1 bugs: 0, 1, 0, 0)
python3-grpcio (1 bugs: 0, 1, 0, 0)
ruby-grpc
ruby-grpc-tools

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:01:57
Last run: 2026-08-15T15:01:28.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:01:52
Last run: 2026-07-28T10:05:03.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:01:21
Last run: 2026-08-24T16:39:21.000Z
Previous status: unknown

Created: 2018-10-24 Last update: 2026-08-24 18:30

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://api.github.com/repos/grpc/grpc/git/matching-refs/tags/ failed: 504 Gateway Timeout

Created: 2026-08-24 Last update: 2026-08-24 16:00

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

https://salsa.debian.org/api/v4/projects/debian%2Fgrpc API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-19 Last update: 2026-08-23 22:32

6 security issues in sid high

There are 6 open security issues in sid.

6 important issues:

CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
CVE-2024-7246: It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
CVE-2023-32732: gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
CVE-2023-33953: gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-11407: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Created: 2023-06-14 Last update: 2026-08-02 20:32

6 security issues in forky high

There are 6 open security issues in forky.

6 important issues:

CVE-2023-4785: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
CVE-2024-7246: It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
CVE-2023-32732: gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
CVE-2023-33953: gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-11407: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Created: 2025-08-09 Last update: 2026-08-02 20:32

lintian reports 65 errors and 39 warnings high

Lintian reports 65 errors and 39 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-04-23 Last update: 2026-04-24 14:30

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-08-15 Last update: 2026-08-24 19:31

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-04-29 Last update: 2026-08-24 18:02

5 low-priority security issues in trixie low

There are 5 open security issues in trixie.

5 issues left for the package maintainer to handle:

CVE-2023-4785: (needs triaging) Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.
CVE-2024-7246: (needs triaging) It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.
CVE-2023-32732: (needs triaging) gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309 https://www.google.com/url
CVE-2023-33953: (needs triaging) gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
CVE-2023-44487: (needs triaging) The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-06-14 Last update: 2026-08-02 20:32

debian/patches: 21 patches to forward upstream low

Among the 23 debian patches available in version 1.51.1-9 of the package, we noticed the following issues:

21 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-04-23 06:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2021-08-18 Last update: 2026-04-23 00:19

testing migrations

This package will soon be part of the auto-protobuf transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-grpc transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-08-10] Accepted grpc 1.83.0-1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Laszlo Boszormenyi)
[2026-07-19] Accepted grpc 1.82.0-1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Laszlo Boszormenyi)
[2026-04-28] grpc 1.51.1-9 MIGRATED to testing (Debian testing watch)
[2026-04-22] Accepted grpc 1.51.1-9 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2026-02-03] Accepted grpc 1.51.1-8 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2026-01-22] grpc 1.51.1-7 MIGRATED to testing (Debian testing watch)
[2026-01-18] Accepted grpc 1.51.1-7 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2025-03-14] grpc 1.51.1-6 MIGRATED to testing (Debian testing watch)
[2025-03-10] Accepted grpc 1.51.1-6 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2024-11-15] grpc 1.51.1-5 MIGRATED to testing (Debian testing watch)
[2024-11-11] Accepted grpc 1.51.1-5 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2024-08-20] Accepted grpc 1.59.5-1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Laszlo Boszormenyi)
[2024-04-29] grpc 1.51.1-4.1 MIGRATED to testing (Debian testing watch)
[2024-02-29] Accepted grpc 1.51.1-4.1 (source) into unstable (Steve Langasek)
[2024-02-17] Accepted grpc 1.51.1-4.1~exp1 (source) into experimental (Steve Langasek)
[2023-12-31] grpc 1.51.1-4 MIGRATED to testing (Debian testing watch)
[2023-12-26] Accepted grpc 1.51.1-4 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2022-12-30] grpc 1.51.1-3 MIGRATED to testing (Debian testing watch)
[2022-12-25] Accepted grpc 1.51.1-3 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2022-12-23] Accepted grpc 1.51.1-2 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2022-12-01] Accepted grpc 1.51.1-1 (source) into experimental (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2022-11-29] Accepted grpc 1.51.0-1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Laszlo Boszormenyi)
[2022-11-15] Accepted grpc 1.50.1-1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Laszlo Boszormenyi)
[2022-10-01] grpc 1.30.2-4 MIGRATED to testing (Debian testing watch)
[2022-09-25] Accepted grpc 1.30.2-4 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2022-06-11] Accepted grpc 1.44.0-3 (source) into experimental (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2022-03-26] Accepted grpc 1.44.0-2 (source) into experimental (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)
[2022-03-22] Accepted grpc 1.44.0-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Laszlo Boszormenyi)
[2021-02-10] grpc 1.30.2-3 MIGRATED to testing (Debian testing watch)
[2021-02-04] Accepted grpc 1.30.2-3 (source) into unstable (Laszlo Boszormenyi (GCS)) (signed by: Laszlo Boszormenyi)

bugs [bug history graph]

all: 20
RC: 3
I&N: 13
M&W: 4
F&P: 0
patch: 3

links

homepage
lintian (65, 39)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.51.1-9