CVE catalog

CVE-2026-84303

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher e

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.31% · Oct 25, 2026

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-google-grpcsid1.81.1-1vulnerable
Debiangolang-google-grpcforky1.81.1-1vulnerable
Debiangolang-google-grpctrixie1.64.0-7vulnerable
Debiangolang-google-grpcbookworm1.33.3-2vulnerable
Gogoogle.golang.org/grpcNot reported1.83.1fixed
Gogoogle.golang.org/grpcNot reported1.83.1fixed
Suseterraform-provider-awslinux enterprise module for public cloud 15 sp43.11.0-150200.6.29.2fixed
Suseterraform-provider-azurermlinux enterprise module for public cloud 15 sp42.32.0-150200.6.23.2fixed
Suseterraform-provider-externallinux enterprise module for public cloud 15 sp42.0.0-150200.6.23.2fixed
Suseterraform-provider-googlelinux enterprise module for public cloud 15 sp43.43.0-150200.6.23.2fixed
Suseterraform-provider-helmlinux enterprise module for public cloud 15 sp42.9.0-150200.6.34.2fixed
Suseterraform-provider-kuberneteslinux enterprise module for public cloud 15 sp41.13.2-150200.6.23.2fixed
Suseterraform-provider-locallinux enterprise module for public cloud 15 sp42.0.0-150200.6.30.2fixed
Suseterraform-provider-nulllinux enterprise module for public cloud 15 sp43.0.0-150200.6.32.2fixed
Suseterraform-provider-randomlinux enterprise module for public cloud 15 sp43.0.0-150200.6.26.2fixed
Suseterraform-provider-tlslinux enterprise module for public cloud 15 sp43.0.0-150200.5.26.2fixed
Suseterraform-provider-awslinux enterprise module for public cloud 15 sp53.11.0-150200.6.29.2fixed
Suseterraform-provider-azurermlinux enterprise module for public cloud 15 sp52.32.0-150200.6.23.2fixed
Suseterraform-provider-externallinux enterprise module for public cloud 15 sp52.0.0-150200.6.23.2fixed
Suseterraform-provider-googlelinux enterprise module for public cloud 15 sp53.43.0-150200.6.23.2fixed
Suseterraform-provider-helmlinux enterprise module for public cloud 15 sp52.9.0-150200.6.34.2fixed
Suseterraform-provider-kuberneteslinux enterprise module for public cloud 15 sp51.13.2-150200.6.23.2fixed
Suseterraform-provider-locallinux enterprise module for public cloud 15 sp52.0.0-150200.6.30.2fixed
Suseterraform-provider-nulllinux enterprise module for public cloud 15 sp53.0.0-150200.6.32.2fixed
Suseterraform-provider-randomlinux enterprise module for public cloud 15 sp53.0.0-150200.6.26.2fixed
Suseterraform-provider-tlslinux enterprise module for public cloud 15 sp53.0.0-150200.5.26.2fixed
Suseterraform-provider-susepubliccloudlinux enterprise module for public cloud 15 sp40.0.1-150100.3.26.1fixed
Suseterraform-provider-susepubliccloudlinux enterprise module for public cloud 15 sp50.0.1-150100.3.26.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp41.300072.0-150400.9.13.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp51.300072.0-150400.9.13.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp61.300072.0-150400.9.13.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp71.300072.0-150400.9.13.1fixed
Suseterraform-provider-susepubliccloudlinux enterprise module for public cloud 15 sp40.0.1-150100.3.23.1fixed
Suseterraform-provider-susepubliccloudlinux enterprise module for public cloud 15 sp50.0.1-150100.3.23.1fixed
Susehelmlinux micro 6.13.21.3-slfo.1.1_3.1fixed
Susehelmlinux micro 6.03.21.3-3.1fixed
Opensusemcphostleap 16.00.34.0-160000.5.1fixed
Opensusev2ray-coretumbleweed5.54.2-1.1fixed
Opensusemcphosttumbleweed0.34.0-11.1fixed
Opensusecadvisorleap 16.00.60.5-bp160.2.1fixed
Suseterraform-provider-nulllinux enterprise module for public cloud 15 sp43.0.0-150200.6.27.1fixed
Suseterraform-provider-nulllinux enterprise module for public cloud 15 sp53.0.0-150200.6.27.1fixed
Opensusegoogle-osconfig-agenttumbleweed20260908.00-1.1fixed
Opensusehaulertumbleweed2.1.0-3.1fixed
Opensusetrivytumbleweed0.74.0-4.1fixed
Opensusecadvisortumbleweed0.60.5-3.1fixed
Opensusehelm3tumbleweed3.21.3-8.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-google-grpcsourcesid(unfixed)not yet assignedNot reported[1146639]
Debiangolang-google-grpcsourceforky(unfixed)not yet assignedNot reported[1146639]
Debiangolang-google-grpcsourcetrixie(unfixed)not yet assignedNot reported[1146639]
Debiangolang-google-grpcsourcebookworm(unfixed)not yet assignedNot reported[1146639]
Gogoogle.golang.org/grpcGoNot reported1.83.1Not reportedGHSA-QC2Q-P7WX-3PX3Not reported
Gogoogle.golang.org/grpcGoNot reported1.83.1Not reportedGO-2026-6441Not reported
Suseterraform-provider-awsrpmlinux enterprise module for public cloud 15 sp43.11.0-150200.6.29.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-azurermrpmlinux enterprise module for public cloud 15 sp42.32.0-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-externalrpmlinux enterprise module for public cloud 15 sp42.0.0-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-googlerpmlinux enterprise module for public cloud 15 sp43.43.0-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-helmrpmlinux enterprise module for public cloud 15 sp42.9.0-150200.6.34.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-kubernetesrpmlinux enterprise module for public cloud 15 sp41.13.2-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-localrpmlinux enterprise module for public cloud 15 sp42.0.0-150200.6.30.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-nullrpmlinux enterprise module for public cloud 15 sp43.0.0-150200.6.32.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-randomrpmlinux enterprise module for public cloud 15 sp43.0.0-150200.6.26.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-tlsrpmlinux enterprise module for public cloud 15 sp43.0.0-150200.5.26.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-awsrpmlinux enterprise module for public cloud 15 sp53.11.0-150200.6.29.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-azurermrpmlinux enterprise module for public cloud 15 sp52.32.0-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-externalrpmlinux enterprise module for public cloud 15 sp52.0.0-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-googlerpmlinux enterprise module for public cloud 15 sp53.43.0-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-helmrpmlinux enterprise module for public cloud 15 sp52.9.0-150200.6.34.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-kubernetesrpmlinux enterprise module for public cloud 15 sp51.13.2-150200.6.23.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-localrpmlinux enterprise module for public cloud 15 sp52.0.0-150200.6.30.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-nullrpmlinux enterprise module for public cloud 15 sp53.0.0-150200.6.32.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-randomrpmlinux enterprise module for public cloud 15 sp53.0.0-150200.6.26.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-tlsrpmlinux enterprise module for public cloud 15 sp53.0.0-150200.5.26.2Not reportedSUSE-SU-2026:4628-1Not reported
Suseterraform-provider-susepubliccloudrpmlinux enterprise module for public cloud 15 sp40.0.1-150100.3.26.1Not reportedSUSE-SU-2026:4444-1Not reported
Suseterraform-provider-susepubliccloudrpmlinux enterprise module for public cloud 15 sp50.0.1-150100.3.26.1Not reportedSUSE-SU-2026:4444-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp41.300072.0-150400.9.13.1Not reportedSUSE-SU-2026:4388-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp51.300072.0-150400.9.13.1Not reportedSUSE-SU-2026:4388-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp61.300072.0-150400.9.13.1Not reportedSUSE-SU-2026:4388-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp71.300072.0-150400.9.13.1Not reportedSUSE-SU-2026:4388-1Not reported
Suseterraform-provider-susepubliccloudrpmlinux enterprise module for public cloud 15 sp40.0.1-150100.3.23.1Not reportedSUSE-SU-2026:4389-1Not reported
Suseterraform-provider-susepubliccloudrpmlinux enterprise module for public cloud 15 sp50.0.1-150100.3.23.1Not reportedSUSE-SU-2026:4389-1Not reported
Susehelmrpmlinux micro 6.13.21.3-slfo.1.1_3.1Not reportedSUSE-SU-2026:23730-1Not reported
Susehelmrpmlinux micro 6.03.21.3-3.1Not reportedSUSE-SU-2026:23546-1Not reported
Opensusemcphostrpmleap 16.00.34.0-160000.5.1Not reportedOPENSUSE-SU-2026:21886-1Not reported
Opensusev2ray-corerpmtumbleweed5.54.2-1.1Not reportedOPENSUSE-SU-2026:11853-1Not reported
Opensusemcphostrpmtumbleweed0.34.0-11.1Not reportedOPENSUSE-SU-2026:11837-1Not reported
Opensusecadvisorrpmleap 16.00.60.5-bp160.2.1Not reportedOPENSUSE-SU-2026:21843-1Not reported
Suseterraform-provider-nullrpmlinux enterprise module for public cloud 15 sp43.0.0-150200.6.27.1Not reportedSUSE-SU-2026:4062-1Not reported
Suseterraform-provider-nullrpmlinux enterprise module for public cloud 15 sp53.0.0-150200.6.27.1Not reportedSUSE-SU-2026:4062-1Not reported
Opensusegoogle-osconfig-agentrpmtumbleweed20260908.00-1.1Not reportedOPENSUSE-SU-2026:11743-1Not reported
Opensusehaulerrpmtumbleweed2.1.0-3.1Not reportedOPENSUSE-SU-2026:11700-1Not reported
Opensusetrivyrpmtumbleweed0.74.0-4.1Not reportedOPENSUSE-SU-2026:11713-1Not reported
Opensusecadvisorrpmtumbleweed0.60.5-3.1Not reportedOPENSUSE-SU-2026:11695-1Not reported
Opensusehelm3rpmtumbleweed3.21.3-8.1Not reportedOPENSUSE-SU-2026:11686-1Not reported

[Debian bug #1146639]

Notes

[trixie] golang-google-grpc: Minor issue [bookworm] golang-google-grpc: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-google-grpc-dev]Affected

    Source package: [golang-google-grpc]

    Details (2)

    • 1.33.3-2 · all · bookworm

      Affected

      nvd · golang-google-grpc · debian · bookworm; nvd · golang-google-grpc · debian · 12

    • 1.33.3-2 · all · bookworm

      Affected

      nvd · golang-google-grpc · debian · bookworm; nvd · golang-google-grpc · debian · 12

  • [protoc-gen-go-grpc]Affected

    Source package: [golang-google-grpc]

    Details (2)

    • 1.33.3-2+b4 · amd64 · bookworm

      Affected

      nvd · golang-google-grpc · debian · bookworm; nvd · golang-google-grpc · debian · 12

    • 1.33.3-2+b4 · arm64 · bookworm

      Affected

      nvd · golang-google-grpc · debian · bookworm; nvd · golang-google-grpc · debian · 12

[Debian 13 (Trixie)]

  • [golang-google-grpc-dev]Affected

    Source package: [golang-google-grpc]

    Details (4)

    • 1.64.0-7 · all · trixie

      Affected

      nvd · golang-google-grpc · debian · 13

    • 1.64.0-7 · all · trixie

      Affected

      nvd · golang-google-grpc · debian · 13

    • 1.79.3-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-google-grpc · debian · 13

    • 1.79.3-1~bpo13+1 · all · trixie-backports

      Affected

      nvd · golang-google-grpc · debian · 13

  • [protoc-gen-go-grpc]Affected

    Source package: [golang-google-grpc]

    Details (4)

    • 1.64.0-7+b2 · amd64 · trixie

      Affected

      nvd · golang-google-grpc · debian · 13

    • 1.64.0-7+b2 · arm64 · trixie

      Affected

      nvd · golang-google-grpc · debian · 13

    • 1.79.3-1~bpo13+1 · amd64 · trixie-backports

      Affected

      nvd · golang-google-grpc · debian · 13

    • 1.79.3-1~bpo13+1 · arm64 · trixie-backports

      Affected

      nvd · golang-google-grpc · debian · 13

[openSUSE Tumbleweed]

  • [cadvisor]Affected

    Source package: [cadvisor]

    Details (1)

    • 0.60.5-2.1 · x86_64 · tumbleweed

      Affected · Fixed: 0.60.5-3.1

      nvd · cadvisor · opensuse · tumbleweed

  • [google-osconfig-agent]Affected

    Source package: [google-osconfig-agent]

    Details (1)

    • 20260803.00-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 20260908.00-1.1

      nvd · google-osconfig-agent · opensuse · tumbleweed

  • [hauler]Affected

    Source package: [hauler]

    Details (1)

    • 2.0.3-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 2.1.0-3.1

      nvd · hauler · opensuse · tumbleweed

  • [helm3]Affected

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · x86_64 · tumbleweed

      Affected · Fixed: 3.21.3-8.1

      nvd · helm3 · opensuse · tumbleweed

  • [mcphost]Affected

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · x86_64 · tumbleweed

      Affected · Fixed: 0.34.0-11.1

      nvd · mcphost · opensuse · tumbleweed

  • [trivy]Affected

    Source package: [trivy]

    Details (1)

    • 0.74.0-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 0.74.0-4.1

      nvd · trivy · opensuse · tumbleweed

  • [v2ray-core]Affected

    Source package: [v2ray-core]

    Details (1)

    • 5.53.0-2.1 · x86_64 · tumbleweed

      Affected · Fixed: 5.54.2-1.1

      nvd · v2ray-core · opensuse · tumbleweed

  • [golang-github-v2fly-v2ray-core]Unknown

    Source package: [v2ray-core]

    Details (1)

    • 5.53.0-2.1 · noarch · tumbleweed

      Unknown · Fixed: 5.54.2-1.1

      Version impact unknown

      nvd · v2ray-core · opensuse · tumbleweed

  • [helm3-bash-completion]Unknown

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · noarch · tumbleweed

      Unknown · Fixed: 3.21.3-8.1

      Version impact unknown

      nvd · helm3 · opensuse · tumbleweed

  • [helm3-fish-completion]Unknown

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · noarch · tumbleweed

      Unknown · Fixed: 3.21.3-8.1

      Version impact unknown

      nvd · helm3 · opensuse · tumbleweed

  • [helm3-zsh-completion]Unknown

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · noarch · tumbleweed

      Unknown · Fixed: 3.21.3-8.1

      Version impact unknown

      nvd · helm3 · opensuse · tumbleweed

  • [mcphost-bash-completion]Unknown

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · noarch · tumbleweed

      Unknown · Fixed: 0.34.0-11.1

      Version impact unknown

      nvd · mcphost · opensuse · tumbleweed

  • [mcphost-fish-completion]Unknown

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · noarch · tumbleweed

      Unknown · Fixed: 0.34.0-11.1

      Version impact unknown

      nvd · mcphost · opensuse · tumbleweed

  • [mcphost-zsh-completion]Unknown

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · noarch · tumbleweed

      Unknown · Fixed: 0.34.0-11.1

      Version impact unknown

      nvd · mcphost · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]