Skip to content
OpenAdvisories

Vendor

grpc

12 known vulnerabilities.

Products

grpc-node 6 grpc-go 4 gRPC-C++ 1 grpc-swift 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.4
    CVE-2026-101916

    @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

    @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertific…

    grpc grpc-node @grpc/grpc-js npm
  • High 8.7
    CVE-2026-84445

    gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProce…

    grpc grpc-go google.golang.org/grpc golang-google-grpc Debian Ubuntu Go
  • High 8.7
    CVE-2026-84304

    gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when…

    grpc grpc-go google-guest-agent google.golang.org/grpc Debian Ubuntu Go
  • High 7.5
    CVE-2026-48069

    @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

    @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-j…

    grpc grpc-node @grpc/grpc-js npm
  • High 7.5
    CVE-2026-48068

    @grpc/grps-js: A malformed request can cause a server crash

    @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-j…

    grpc grpc-node @grpc/grpc-js npm
  • High 7.5
    CVE-2022-24777

    Denial of Service via reachable assertion in grpc-swift

    grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling G…

    grpc grpc-swift github.com/grpc/grpc-swift SwiftURL