SB2026081946 - Multiple vulnerabilities in grpc-go

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081946

SB2026081946 - Multiple vulnerabilities in grpc-go

Published: August 19, 2026

Security Bulletin ID SB2026081946
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to improper access control in the xDS RBAC authorization engine when translating xDS RBAC policies containing unsupported Metadata or RequestedServerName matchers. A remote attacker can supply or rely on crafted policy conditions to bypass authorization checks.

If the authorization policy relies on these matchers for access control, unsupported rules may be treated as no-ops and logical NOT, OR, or AND nesting can alter boolean policy evaluation.


2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the HTTP/2 transport server implementation when handling rapid client-initiated stream creation and reset sequences. A remote attacker can send a rapid flood of HEADERS followed by RST_STREAM frames to cause a denial of service.

The condition bypasses the HTTP/2 Rapid Reset mitigation because queued control buffer items do not count against the transport response frame threshold, leading to high CPU consumption.


3) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the xDS RBAC policy translator when parsing crafted xDS RBAC policies containing NOT rules around unsupported fields. A remote attacker can deliver a crafted LDS or RDS update to cause a denial of service.

The issue occurs when a NOT rule wraps an unsupported or unhandled field such as SourcedMetadata, which can produce an empty matcher and trigger a runtime panic during authorization of an incoming request.


Remediation

Install update from vendor's website.

References