Executive brief
gRPC-Go, a popular framework for building high-performance services, is affected by multiple vulnerabilities in its authorization and transport components. These flaws could allow unauthorized users to bypass security policies and access restricted data, or enable attackers to crash the server and disrupt operations through denial-of-service attacks. Organizations using gRPC-Go with xDS-based security policies or exposed to public internet traffic should update to the latest version to maintain service availability and data integrity.
Technical details
gRPC-Go contains three distinct vulnerabilities: 1) An authorization bypass in the xDS RBAC engine where 'Metadata' and 'RequestedServerName' matchers were silently ignored, potentially causing policies to fail-open. 2) A Denial of Service (DoS) via HTTP/2 Rapid Reset mitigation bypass, where client-initiated stream resets (RST_STREAM) following HEADERS frames could bypass control buffer thresholds, leading to high CPU consumption. 3) A server panic (CWE-248) in the xDS RBAC engine triggered by 'NOT' rules wrapping unsupported fields like 'SourcedMetadata'. These issues are addressed in version 1.82.1 by enforcing control buffer limits and correctly translating previously unsupported RBAC matchers.
Affected products
- gRPC grpc-go < 1.82.1
Timeline
- 2026-07-15: patched: Fixes merged into master and v1.82.x branch
- 2026-07-21: advisory: GitHub Advisory GHSA-hrxh-6v49-42gf published
References
- https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf
- https://github.com/grpc/grpc-go/pull/9236
- https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935
- https://github.com/grpc/grpc-go/releases/tag/v1.82.1
- https://api.github.com/repos/grpc/grpc-go/security-advisories/GHSA-hrxh-6v49-42gf