Start for Free
go

google.golang.org/grpc

View on go registry
14 Total advisories
14 Vulnerabilities
0 Malware

Dependency scanning

Check whether google.golang.org/grpc is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

UNKNOWN
Go

CVE-2026-84445

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
UNKNOWN
Go

CVE-2026-84304

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
UNKNOWN
Go

CVE-2026-84303

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
UNKNOWN
Go

CVE-2026-84445

Server panic via missing authority or Host headers in google.golang.org/grpc
UNKNOWN
Go

CVE-2026-84303

Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc
UNKNOWN
Go

CVE-2026-84304

Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc
UNKNOWN
Go

GO-2026-6061

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
CRITICAL 9.1
Go

CVE-2026-33186

gRPC-Go has an authorization bypass via missing leading slash in :path
UNKNOWN
Go

GO-2024-2978

Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go
HIGH 7.5
Go

GO-2023-2153

gRPC-Go HTTP/2 Rapid Reset vulnerability
UNKNOWN
Go

GHSA-hrxh-6v49-42gf

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc
UNKNOWN
Go

CVE-2026-33186

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
UNKNOWN
Go

GHSA-xr7q-jx4m-x55m

Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc
UNKNOWN
Go

GHSA-m425-mq94-257g

Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes