google.golang.org/grpc
Activity
- Latest release
- 4d ago
- Total releases
- 71
- Cadence
- ~20 days
- Last 12 months
- 25
Details
- First release
- Dec 04, 2017
| Version | Released | |
|---|---|---|
v1.85.0
minor
|
v1.85.0
minor
Dependencies (22)
+ 14 more |
|
v1.86.0-dev
pre
|
v1.86.0-dev
pre
Dependencies (24)
+ 16 more |
|
v1.84.0
minor
|
v1.84.0
minor
Dependencies (24)
+ 16 more |
|
v1.83.2
patch
|
v1.83.2
patch
Dependencies (24)
+ 16 more |
|
v1.82.2
patch
2 CVEs
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev |
v1.82.2
patch
Dependencies (22)
+ 14 more |
|
v1.83.1
patch
1 CVE
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev |
v1.83.1
patch
Dependencies (24)
+ 16 more |
|
v1.85.0-dev
pre
1 CVE
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev |
v1.85.0-dev
pre
Dependencies (24)
+ 16 more |
|
v1.83.0
minor
3 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev |
v1.83.0
minor
Dependencies (24)
+ 16 more |
|
v1.82.1
patch
3 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev |
v1.82.1
patch
Dependencies (22)
+ 14 more |
|
v1.84.0-dev
pre
1 CVE
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev |
v1.84.0-dev
pre
Dependencies (24)
+ 16 more |
|
v1.82.0
minor
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.82.0
minor
Dependencies (22)
+ 14 more |
|
v1.83.0-dev
pre
2 CVEs
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev |
v1.83.0-dev
pre
Dependencies (22)
+ 14 more |
|
v1.81.1
patch
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.81.1
patch
Dependencies (22)
+ 14 more |
|
v1.81.0
minor
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.81.0
minor
Dependencies (22)
+ 14 more |
|
v1.82.0-dev
pre
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.82.0-dev
pre
Dependencies (22)
+ 14 more |
|
v1.80.0
minor
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.80.0
minor
Dependencies (22)
+ 14 more |
|
v1.79.3
patch
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.79.3
patch
Dependencies (22)
+ 14 more |
|
v1.81.0-dev
pre
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.81.0-dev
pre
Dependencies (22)
+ 14 more |
|
v1.79.2
patch
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.79.2
patch
Dependencies (22)
+ 14 more |
|
v1.79.1
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.79.1
minor
Dependencies (22)
+ 14 more |
|
v1.79.0
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.79.0
minor
Dependencies (22)
+ 14 more |
|
v1.80.0-dev
pre
4 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev |
v1.80.0-dev
pre
Dependencies (22)
+ 14 more |
|
v1.78.0
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.78.0
minor
Dependencies (22)
+ 14 more |
|
v1.79.0-dev
pre
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.79.0-dev
pre
Dependencies (22)
+ 14 more |
|
v1.77.0
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.77.0
minor
Dependencies (22)
+ 14 more |
|
v1.78.0-dev
pre
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.78.0-dev
pre
Dependencies (22)
+ 14 more |
|
v1.77.0-dev
pre
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.77.0-dev
pre
Dependencies (22)
+ 14 more |
|
v1.72.3
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.72.3
minor
Dependencies (21)
+ 13 more |
|
v1.71.3
patch
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.71.3
patch
Dependencies (20)
+ 12 more |
|
v1.71.2
patch
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.71.2
patch
Dependencies (20)
+ 12 more |
|
v1.71.1
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.71.1
minor
Dependencies (20)
+ 12 more |
|
v1.70.0
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.70.0
minor
Dependencies (19)
+ 11 more |
|
v1.71.0-dev
pre
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.71.0-dev
pre
Dependencies (19)
+ 11 more |
|
v1.68.2
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.68.2
minor
Dependencies (18)
+ 10 more |
|
v1.67.3
patch
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.67.3
patch
Dependencies (17)
+ 9 more |
|
v1.66.3
patch
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.66.3
patch
Dependencies (12)
+ 4 more |
|
v1.67.1
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.67.1
minor
Dependencies (12)
+ 4 more |
|
v1.66.1
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.66.1
minor
Dependencies (12)
+ 4 more |
|
v1.67.0-dev
pre
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.67.0-dev
pre
Dependencies (12)
+ 4 more |
|
v1.60.0
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.60.0
minor
Dependencies (14)
+ 6 more |
|
v1.56.3
minor
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.56.3
minor
Dependencies (13)
+ 5 more |
|
v1.58.3
patch
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.58.3
patch
Dependencies (14)
+ 6 more |
|
v1.58.1
minor
6 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev
GO-2023-2153
GHSA-m425-mq94-257g
Nov 01, 2023
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption. Fixed in
1.56.3
1.57.1
1.58.3
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.58.1
minor
Dependencies (14)
+ 6 more |
|
v1.57.0
minor
6 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev
GO-2023-2153
GHSA-m425-mq94-257g
Nov 01, 2023
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption. Fixed in
1.56.3
1.57.1
1.58.3
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.57.0
minor
Dependencies (14)
+ 6 more |
|
v1.55.1
minor
6 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev
GO-2023-2153
GHSA-m425-mq94-257g
Nov 01, 2023
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption. Fixed in
1.56.3
1.57.1
1.58.3
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.55.1
minor
Dependencies (13)
+ 5 more |
|
v1.57.0-dev
pre
5 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev |
v1.57.0-dev
pre
Dependencies (13)
+ 5 more |
|
v1.54.1
patch
6 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev
GO-2023-2153
GHSA-m425-mq94-257g
Nov 01, 2023
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption. Fixed in
1.56.3
1.57.1
1.58.3
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.54.1
patch
Dependencies (13)
+ 5 more |
|
v1.54.0
minor
6 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev
GO-2023-2153
GHSA-m425-mq94-257g
Nov 01, 2023
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption. Fixed in
1.56.3
1.57.1
1.58.3
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.54.0
minor
Dependencies (13)
+ 5 more |
|
v1.52.3
minor
6 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev
GO-2023-2153
GHSA-m425-mq94-257g
Nov 01, 2023
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption. Fixed in
1.56.3
1.57.1
1.58.3
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.52.3
minor
Dependencies (13)
+ 5 more |
|
v1.53.0-dev
pre
6 CVEs
CVE-2026-84445
GO-2026-6443
GHSA-2v4p-qf9q-27wj
Sep 15, 2026
Server panic via missing authority or Host headers in google.golang.org/grpc In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. Fixed in
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e
References Updated Oct 07, 2026 · Source: OSV.dev
CVE-2026-84303
GO-2026-6441
GHSA-qc2q-p7wx-3px3
Sep 15, 2026
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing. Fixed in
1.83.1
References Updated Sep 15, 2026 · Source: OSV.dev
CVE-2026-84304
GO-2026-6348
GHSA-vp52-pcj8-j9qc
Sep 15, 2026
Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc Fixed in
1.83.1
References
Updated Sep 15, 2026 · Source: OSV.dev
GO-2026-6061
GHSA-hrxh-6v49-42gf
Jul 27, 2026
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc Fixed in
1.82.1
References Updated Jul 28, 2026 · Source: OSV.dev
CVE-2026-33186
GO-2026-4762
GHSA-p77j-4mvh-x3m3
Mar 27, 2026
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc Fixed in
1.79.3
Updated Mar 30, 2026 · Source: OSV.dev
GO-2023-2153
GHSA-m425-mq94-257g
Nov 01, 2023
Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption. Fixed in
1.56.3
1.57.1
1.58.3
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.53.0-dev
pre
Dependencies (13)
+ 5 more |