GHSA-HRXH-6V49-42GF: HTTP/2 Control Buffer Flooding and xDS RBAC Parsing Weaknesses in gRPC-Go
Vulnerability ID: GHSA-HRXH-6V49-42GF
CVSS Score: 8.6
Published: 2026-07-21
GHSA-HRXH-6V49-42GF is a critical security advisory addressing two distinct vulnerabilities within gRPC-Go: an HTTP/2 Control Buffer Flooding weakness that allows unauthenticated denial of service, and xDS Role-Based Access Control parser weaknesses that lead to authorization bypasses and application panics.
TL;DR
gRPC-Go is vulnerable to a denial-of-service bypass due to incomplete HTTP/2 Rapid Reset mitigation, alongside xDS RBAC parsing flaws that cause application panics or silent authorization bypasses.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400
- Attack Vector: Network (AV:N)
- CVSS v3.1: 8.6
- Impact: Denial of Service (DoS) & Authorization Bypass
- Exploit Status: Proof of Concept (PoC) available
- KEV Status: Not listed
Affected Systems
- gRPC-Go (google.golang.org/grpc)
-
gRPC-Go: < 1.82.1 (Fixed in:
1.82.1)
Code Analysis
Commit: 4ea465d
Implement control buffer throttle limit and fix xDS RBAC parsing weaknesses
Mitigation Strategies
- Upgrade gRPC-Go to version 1.82.1 or newer
- Tune GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT environment variable
- Implement HTTP/2 frame rate limits at reverse proxy/WAF level
Remediation Steps:
- Identify all Go services using google.golang.org/grpc in go.mod
- Execute 'go get google.golang.org/grpc@v1.82.1' to update dependencies
- Run 'go mod tidy' and verify the dependency graph
- Rebuild and redeploy the affected microservices
- Monitor memory consumption and HTTP/2 stream dynamics in production
References
- GitHub Advisory: GHSA-HRXH-6V49-42GF
- Official Fix Commit
- Official Pull Request #9236
- grpc-go v1.82.1 Release
Read the full report for GHSA-HRXH-6V49-42GF on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)