Is CVE-2024-7246 actively exploited?

No active exploitation of CVE-2024-7246 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-7246 be exploited remotely?

Yes. CVE-2024-7246 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-7246?

CVE-2024-7246 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2024-7246

MEDIUM

CVE-2024-7246

CWE-440Published: August 6, 2024· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values.

This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table.

Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.

NVD Source

Technical Analysis

CVE-2024-7246 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.