Go - OSV

GO-2026-6348

Go/google.golang.org/grpc

Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc 15 Sep

Fix available

GO-2026-6441

Go/google.golang.org/grpc

Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc 15 Sep

Fix available

GO-2026-6443

Go/google.golang.org/grpc

Server panic via missing authority or Host headers in google.golang.org/grpc 15 Sep

Fix available

GHSA-2v4p-qf9q-27wj

Go/google.golang.org/grpc

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-qc2q-p7wx-3px3

Go/google.golang.org/grpc

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion 08 Sep

Fix available
Severity - 6.3 (Medium)

GHSA-vp52-pcj8-j9qc

Go/google.golang.org/grpc

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation 01 Sep

Fix available
Severity - 8.7 (High)

GO-2026-6061

Go/google.golang.org/grpc

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc 27 Jul

Fix available

GHSA-hrxh-6v49-42gf

Go/google.golang.org/grpc

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities 21 Jul

Fix available
Severity - 8.8 (High)

GO-2026-4762

Go/google.golang.org/grpc

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc 27 Mar

Fix available

GHSA-p77j-4mvh-x3m3

Go/google.golang.org/grpc

gRPC-Go has an authorization bypass via missing leading slash in :path 18 Mar

Fix available
Severity - 9.1 (Critical)

GO-2024-2978

Go/google.golang.org/grpc

Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc 09 Jul 2024

Fix available

GHSA-xr7q-jx4m-x55m

Go/google.golang.org/grpc

Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go 05 Jul 2024

Fix available

GO-2023-2153

Go/google.golang.org/grpc

Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc 01 Nov 2023

Fix available

GHSA-m425-mq94-257g

Go/google.golang.org/grpc

gRPC-Go HTTP/2 Rapid Reset vulnerability 25 Oct 2023

Fix available
Severity - 7.5 (High)