Skip to content
OpenAdvisories

Package · Go

google.golang.org/grpc

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-84445

    gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProce…

    grpc grpc-go katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Wolfi Go
  • High 8.7
    CVE-2026-84304

    gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when…

    grpc grpc-go katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Wolfi Go
  • High —
    GHSA-hrxh-6v49-42gf

    gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

    Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in: - Autho…

    google.golang.org/grpc Go
  • High 7.5
    GHSA-m425-mq94-257g

    gRPC-Go HTTP/2 Rapid Reset vulnerability

    ### Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers …

    google.golang.org/grpc Go