GHSA-hrxh-6v49-42gf

A vulnerability in gRPC-Go before version 1.79.3 allows authorization bypass due to improper validation of the HTTP/2 `:path` pseudo-header. The server accepted requests with a missing leading slash (e.g., `Service/Method` instead of `/Service/Method`), causing deny rules based on canonical paths to be ineffective. An attacker can exploit this to bypass security policies if a fallback allow rule exists.

gRPC-Go prior to 1.82.2 and 1.83.2 allows servers created with xds.NewGRPCServer() to accept an RPC lacking both the :authority and Host headers. RouteAndProcess assumes an authority value exists and indexes an empty slice, causing an index-out-of-bounds panic that terminates the entire server process.

gRPC-Go prior to 1.83.1 stores each fragmented HTTP/2 DATA frame as a separate recvMsg, so millions of one-byte frames can consume disproportionate heap memory. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or OOM termination. Receive-buffer compaction is enabled by default and can be controlled with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. Fixed in 1.83.1.

gRPC-Go prior to version 1.83.1 contains a vulnerability in the xDS RBAC HTTP filter where header matcher names are not lowercased even though incoming metadata keys are lowercase. A DENY policy using mixed-case names such as X-Role or User-Agent does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.