grpc/grpc-go Security Advisories | GitStock

high2026-09-08

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

GHSA-2v4p-qf9q-27wj · CVE-2026-84445

medium2026-09-08

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

GHSA-qc2q-p7wx-3px3 · CVE-2026-84303

high2026-09-01

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

GHSA-vp52-pcj8-j9qc · CVE-2026-84304

high2026-07-21

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

GHSA-hrxh-6v49-42gf

critical2026-03-18

gRPC-Go has an authorization bypass via missing leading slash in :path

GHSA-p77j-4mvh-x3m3 · CVE-2026-33186

low2024-07-05

Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

GHSA-xr7q-jx4m-x55m

high2023-10-25

gRPC-Go HTTP/2 Rapid Reset vulnerability

GHSA-m425-mq94-257g