SB2026081947 - Multiple vulnerabilities in grpc-go

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper Handling of Case Sensitivity (CVE-ID: N/A)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authorization policies.

The vulnerability exists due to improper handling of case sensitivity in the xDS RBAC HTTP filter implementation when matching request headers against configured RBAC header rules. A remote attacker can send requests using mixed-case or canonical-case headers to bypass authorization policies.

Requests that should be rejected under DENY rules may instead be served because incoming metadata keys are lowercased before evaluation.

2) Improper Handling of Case Sensitivity (CVE-ID: N/A)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass header validation restrictions.

The vulnerability exists due to improper handling of case sensitivity in the gRFC A41 header matcher validation logic when validating grpc-prefixed header matchers. A remote attacker can use alternate header casing to bypass header validation restrictions.

The protection intended to reject configuration schemas using grpc-prefixed headers can be evaded with case variations such as Grpc-Status.

3) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the HTTP/2 DATA frame handling logic when processing highly fragmented gRPC stream payloads. A remote attacker can send a large number of tiny HTTP/2 DATA frames across one or more streams to cause a denial of service.

The issue can exhaust heap memory and trigger a runtime panic or out-of-memory condition even when the total payload remains within configured connection and stream flow-control windows.

Remediation

Install update from vendor's website.

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3
• https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc