google.golang.org/grpc (Go)
The Go language implementation of gRPC. HTTP/2 based RPC
Advisories
27
Latest version
v1.85.0
Released Oct 27, 2026
License
Apache-2.0
OpenSSF Scorecard
8.5 / 10
How to fix
Upgrading to 1.85.0-dev.0.20260825072537-93e31b48545e or later clears every advisory below that has a fix.
Upgrade commands
go
go get google.golang.org/grpc@v1.85.0 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
< 1.82.2>= 1.83.0, < 1.83.2>= 1.84.0-dev, < 1.84.0-dev.0.20260825144003-d5a41119e0e3>= 1.85.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e | 1.82.21.83.21.84.0-dev.0.20260825144003-d5a41119e0e31.85.0-dev.0.20260825072537-93e31b48545e |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
>= 1.84.0-dev, < 1.84.0-dev.0.20260825144003-d5a41119e0e3 | 1.84.0-dev.0.20260825144003-d5a41119e0e3 |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
>= 1.83.0, < 1.83.2 | 1.83.2 |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
< 1.82.2 | 1.82.2 |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
>= 1.85.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e | 1.85.0-dev.0.20260825072537-93e31b48545e |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
>= 1.84.0-dev, < 1.84.0-dev.0.20260825144003-d5a41119e0e3 | 1.84.0-dev.0.20260825144003-d5a41119e0e3 |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
>= 1.83.0, < 1.83.2 | 1.83.2 |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
< 1.82.2 | 1.82.2 |
| GHSA-2v4p-qf9q-27wj gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers |
High EPSS 0.64% |
>= 1.85.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e | 1.85.0-dev.0.20260825072537-93e31b48545e |
| GHSA-vp52-pcj8-j9qc gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation |
High EPSS 0.61% |
< 1.83.1 | 1.83.1 |
| GHSA-vp52-pcj8-j9qc gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation |
High EPSS 0.61% |
< 1.83.1 | 1.83.1 |
| GHSA-vp52-pcj8-j9qc gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation |
High EPSS 0.61% |
<= 1.83.0 | No fix yet |
| GHSA-qc2q-p7wx-3px3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion |
Medium EPSS 0.31% |
<= 1.83.0 | No fix yet |
| GHSA-qc2q-p7wx-3px3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion |
Medium EPSS 0.31% |
< 1.83.1 | 1.83.1 |
| GHSA-qc2q-p7wx-3px3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion |
Medium EPSS 0.31% |
< 1.83.1 | 1.83.1 |
| GHSA-hrxh-6v49-42gf gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities |
High | < 1.82.1 | 1.82.1 |
| GHSA-hrxh-6v49-42gf gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities |
High | < 1.82.1 | 1.82.1 |
| GHSA-hrxh-6v49-42gf gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities |
High | < 1.82.1 | 1.82.1 |
| GHSA-p77j-4mvh-x3m3 gRPC-Go has an authorization bypass via missing leading slash in :path |
Critical EPSS 1.58% |
< 1.79.3 | 1.79.3 |
| GHSA-p77j-4mvh-x3m3 gRPC-Go has an authorization bypass via missing leading slash in :path |
Critical EPSS 1.58% |
< 1.79.3 | 1.79.3 |
| GHSA-p77j-4mvh-x3m3 gRPC-Go has an authorization bypass via missing leading slash in :path |
Critical EPSS 1.58% |
< 1.79.3 | 1.79.3 |
| GHSA-xr7q-jx4m-x55m Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go |
Low | >= 1.64.0, < 1.64.1 | 1.64.1 |
| GHSA-xr7q-jx4m-x55m Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go |
Low | >= 1.64.0, < 1.64.1 | 1.64.1 |
| GHSA-m425-mq94-257g gRPC-Go HTTP/2 Rapid Reset vulnerability Known exploited |
High EPSS 100.00% |
< 1.56.3>= 1.57.0, < 1.57.1>= 1.58.0, < 1.58.3 | 1.56.31.57.11.58.3 |
| GHSA-m425-mq94-257g gRPC-Go HTTP/2 Rapid Reset vulnerability Known exploited |
High EPSS 100.00% |
>= 1.58.0, < 1.58.3 | 1.58.3 |
| GHSA-m425-mq94-257g gRPC-Go HTTP/2 Rapid Reset vulnerability Known exploited |
High EPSS 100.00% |
>= 1.57.0, < 1.57.1 | 1.57.1 |
| GHSA-m425-mq94-257g gRPC-Go HTTP/2 Rapid Reset vulnerability Known exploited |
High EPSS 100.00% |
< 1.56.3 | 1.56.3 |
Source: https://github.com/grpc/grpc-go
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor