Source: golang-google-grpc Version: 1.81.1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for golang-google-grpc. CVE-2026-84303[0]: | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, | the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go | does not lowercase header matcher names in normalizeHeaderMatcher | even though incoming metadata keys are lowercase. A DENY policy | using a mixed-case name such as X-Role or User-Agent therefore does | not match and fails open, allowing requests that should be rejected. | The same case mismatch permits :Scheme or Grpc-Status to evade gRFC | A41 validation and prevents Host from being rewritten to :authority. | This issue is fixed in version 1.83.1. CVE-2026-84304[1]: | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, | internal/transport/transport.go stores each fragmented HTTP/2 DATA | frame as a separate recvMsg in recvBuffer, so millions of one-byte | frames can consume disproportionate heap memory even when payload | bytes remain within connection and stream flow-control windows. An | unauthenticated remote attacker can use concurrent multiplexed | streams to exhaust process memory and cause a runtime panic or out- | of-memory termination. Receive-buffer compaction is enabled by | default and can be controlled temporarily with | GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is | fixed in version 1.83.1. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-84303 https://www.cve.org/CVERecord?id=CVE-2026-84303 [1] https://security-tracker.debian.org/tracker/CVE-2026-84304 https://www.cve.org/CVERecord?id=CVE-2026-84304 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
