Go/google.golang.org/grpc CVE-2026-84303: medium, EPSS 0.31%

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Action: Upgrade google.golang.org/grpc to 1.83.1 or later.

go get google.golang.org/grpc@v1.83.1

Affected

Fixed versions

Sources

• osv: GHSA-qc2q-p7wx-3px3
• https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3
• https://nvd.nist.gov/vuln/detail/CVE-2026-84303
• https://github.com/grpc/grpc-go/pull/9332
• https://github.com/grpc/grpc-go/pull/9335
• https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8
• https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.83.1

CVE-2026-84303 · published 2026-09-08T20:50:21Z · modified 2026-09-15T19:10:32.558419529Z · JSON