Skip to content
OpenAdvisories

Package · Go

google.golang.org/grpc

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.7
    CVE-2026-84445

    gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProce…

    grpc grpc-go katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Wolfi Go
  • High 8.7
    CVE-2026-84304

    gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when…

    grpc grpc-go katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.3
    CVE-2026-84303

    gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY pol…

    grpc grpc-go kubeflow-pipelines-apiserver helm-3 Debian Ubuntu Azure Linux Wolfi Go
  • High —
    GHSA-hrxh-6v49-42gf

    gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

    Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in: - Autho…

    google.golang.org/grpc Go
  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go
  • Low —
    GHSA-xr7q-jx4m-x55m

    Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

    ### Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. ### Patches The issue first appe…

    google.golang.org/grpc Go
  • High 7.5
    GHSA-m425-mq94-257g

    gRPC-Go HTTP/2 Rapid Reset vulnerability

    ### Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers …

    google.golang.org/grpc Go