Grpc Go
Monthly
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.
Memory exhaustion in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to crash any service built on this library by sending HTTP/2 streams fragmented into millions of tiny one-byte DATA frames. Each fragment is stored as a separate recvMsg object in recvBuffer, creating severe heap overhead that bypasses HTTP/2 flow-control protections - which limit payload bytes, not the number of allocated metadata objects. No public exploit has been identified at time of analysis, but the attack is fully derivable from the public GitHub advisory and PR diff.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.