GR
Product
grpc-go
4
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 1Low 0
Watch
Add grpc-go to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33186 | 9.1 | Mar 20 | gRPC-Go has an authorization bypass via missing leading slash in :path Affected: < 1.79.3 |
| CVE-2026-84445 | 8.7 | Sep 14 | gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers Affected: < 1.82.2; >= 1.83.0, < 1.83.2 |
| CVE-2026-84304 | 8.7 | Sep 1 | gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation Affected: < 1.83.1 |
| CVE-2026-84303 | 6.3 | Sep 1 | gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion Affected: < 1.83.1 |
Showing 4