PkgSeer

Vulnerability GO-2026-6441

Unknown

4 hours ago

Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc

v1.0.0 - v1.83.0

Summary

Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc

Details

In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc

v1.0.0 - v1.83.0 GO-2026-6348

Server panic via missing authority or Host headers in google.golang.org/grpc

v1.0.0 - v1.82.1 GO-2026-6443

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

v1.0.0 - v1.82.1 and v1.83.0 - v1.83.1 and v1.84.0-dev - v1.85.0-dev GHSA-2v4p-qf9q-27wj

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

v1.0.0 - v1.83.0 GHSA-qc2q-p7wx-3px3

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

v1.0.0 - v1.83.0 GHSA-vp52-pcj8-j9qc

View all vulnerabilities for these packages

Impacted packages

google.golang.org/grpc

Timeline

Published

4 hours ago

Last Modified

4 hours ago