Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

Description

References

• grpc/grpc-go security advisory · ADVISORY
• grpc/grpc-go commit 4ea465d · FIX
• grpc/grpc-go#9236 · WEB
• grpc/grpc-go release v1.82.1 · WEB

google.golang.org/grpc 的其他漏洞

• CVE-2026-84445高危 8.7gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/trans…
• CVE-2026-84304高危 8.7gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame…
• CVE-2026-84303中危 6.3gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does no…
• GHSA-hrxh-6v49-42gf高危gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
• CVE-2026-33186严重 9.1gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input valid…