CVE-2026-84303
2 advisories.
Go/google.golang.org/grpc CVE-2026-84303: medium, EPSS 0.31%
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Action: Upgrade google.golang.org/grpc to 1.83.1 or later.
go get google.golang.org/grpc@v1.83.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.83.1 | - |
Fixed versions
| 1.83.1 |
Sources
- osv: GHSA-qc2q-p7wx-3px3
- https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3
- https://nvd.nist.gov/vuln/detail/CVE-2026-84303
- https://github.com/grpc/grpc-go/pull/9332
- https://github.com/grpc/grpc-go/pull/9335
- https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8
- https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe
- https://github.com/grpc/grpc-go
- https://github.com/grpc/grpc-go/releases/tag/v1.83.1
CVE-2026-84303 · published · modified · JSON
Go/google.golang.org/grpc CVE-2026-84303: unknown, EPSS 0.31%
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc
Action: Upgrade google.golang.org/grpc to 1.83.1 or later.
go get google.golang.org/grpc@v1.83.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.83.1 | - |
Fixed versions
| 1.83.1 |
Sources
- osv: GO-2026-6441
- https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3
- https://github.com/grpc/grpc-go/pull/9332
CVE-2026-84303 · published · modified · JSON