DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-HRXH-6V49-42GF: GHSA-HRXH-6V49-42GF: HTTP/2 Control Buffer Flooding and xDS RBAC Parsing Weaknesses in gRPC-Go

GHSA-HRXH-6V49-42GF: HTTP/2 Control Buffer Flooding and xDS RBAC Parsing Weaknesses in gRPC-Go

Vulnerability ID: GHSA-HRXH-6V49-42GF
CVSS Score: 8.6
Published: 2026-07-21

GHSA-HRXH-6V49-42GF is a critical security advisory addressing two distinct vulnerabilities within gRPC-Go: an HTTP/2 Control Buffer Flooding weakness that allows unauthenticated denial of service, and xDS Role-Based Access Control parser weaknesses that lead to authorization bypasses and application panics.

TL;DR

gRPC-Go is vulnerable to a denial-of-service bypass due to incomplete HTTP/2 Rapid Reset mitigation, alongside xDS RBAC parsing flaws that cause application panics or silent authorization bypasses.


⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 8.6
  • Impact: Denial of Service (DoS) & Authorization Bypass
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • gRPC-Go (google.golang.org/grpc)
  • gRPC-Go: < 1.82.1 (Fixed in: 1.82.1)

Code Analysis

Commit: 4ea465d

Implement control buffer throttle limit and fix xDS RBAC parsing weaknesses

Mitigation Strategies

  • Upgrade gRPC-Go to version 1.82.1 or newer
  • Tune GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT environment variable
  • Implement HTTP/2 frame rate limits at reverse proxy/WAF level

Remediation Steps:

  1. Identify all Go services using google.golang.org/grpc in go.mod
  2. Execute 'go get google.golang.org/grpc@v1.82.1' to update dependencies
  3. Run 'go mod tidy' and verify the dependency graph
  4. Rebuild and redeploy the affected microservices
  5. Monitor memory consumption and HTTP/2 stream dynamics in production

References


Read the full report for GHSA-HRXH-6V49-42GF on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)