google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

CLEANSTART-2026-XR21896 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-DX35599 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-UJ30602 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-QF95955 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the kube-state-metrics-fips package. gRPC-Go is the Go language implementation of gRPC...

RHEL 9 : opentelemetry-collector (RHSA-2026:76744)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76744 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: google.golang.org/grpc: gRPC-Go: Denial of Service via...

opentelemetry-collector security update

An update is available for opentelemetry-collector. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Collector with the supported components for a Rocky Enterpri...

RLSA-2026:76743 Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84445 For more details about the security issues, including the impact, a CVSS score,...

RockyLinux 10 : opentelemetry-collector (RLSA-2026:76743)

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:76743 advisory. google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84445 Tenable has extracted the preceding description block directly from...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

OPENSUSE-SU-2026:22026-1 Security update for prometheus-blackbox_exporter

This update for prometheus-blackboxexporter fixes the following issues: Changes in prometheus-blackboxexporter: - CVE-2026-84304: Fix heap memory exhaustion OOM via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 bsc1279126 - CVE-2026-39821: Fix potential validation...

CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC 권한 부여 정책 우회 :path 슬래시 누락으로 인한 인증 우회 설명 google.golang.org/grpc의 authz 패키지는 SDK 수준 RBAC 권한 부여를 구현하며, :path 유사 헤더에 대해 거부 및 허용 규칙을 매칭합니다. HTTP/2 서버 전송 계층은 클라이언트로부터 원시 :path 값을 /로 시작하는지 검증 없이 저장합니다. 라우팅 계층handleStream은 디스패치 전에 경로를 정규화하지만, RBAC 엔진은 grpc.Methodctx를 통해 컨텍스트에서...

CLEANSTART-2026-QT50879 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-WO88386 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...