GHSA-HRXH-6V49-42GF: HTTP/2 Control Buffer Flooding and xDS RBAC Parsing Weaknesses in gRPC-Go

Vulnerability ID: GHSA-HRXH-6V49-42GF
CVSS Score: 8.6
Published: 2026-07-21

GHSA-HRXH-6V49-42GF is a critical security advisory addressing two distinct vulnerabilities within gRPC-Go: an HTTP/2 Control Buffer Flooding weakness that allows unauthenticated denial of service, and xDS Role-Based Access Control parser weaknesses that lead to authorization bypasses and application panics.

TL;DR

gRPC-Go is vulnerable to a denial-of-service bypass due to incomplete HTTP/2 Rapid Reset mitigation, alongside xDS RBAC parsing flaws that cause application panics or silent authorization bypasses.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-400
• Attack Vector: Network (AV:N)
• CVSS v3.1: 8.6
• Impact: Denial of Service (DoS) & Authorization Bypass
• Exploit Status: Proof of Concept (PoC) available
• KEV Status: Not listed

Affected Systems

• gRPC-Go (google.golang.org/grpc)
• gRPC-Go: < 1.82.1 (Fixed in: 1.82.1)

Code Analysis

Commit: 4ea465d

Implement control buffer throttle limit and fix xDS RBAC parsing weaknesses

Mitigation Strategies

• Upgrade gRPC-Go to version 1.82.1 or newer
• Tune GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT environment variable
• Implement HTTP/2 frame rate limits at reverse proxy/WAF level

Remediation Steps:

1. Identify all Go services using google.golang.org/grpc in go.mod
2. Execute 'go get google.golang.org/[email protected]' to update dependencies
3. Run 'go mod tidy' and verify the dependency graph
4. Rebuild and redeploy the affected microservices
5. Monitor memory consumption and HTTP/2 stream dynamics in production

References

• GitHub Advisory: GHSA-HRXH-6V49-42GF
• Official Fix Commit
• Official Pull Request #9236
• grpc-go v1.82.1 Release

Read the full report for GHSA-HRXH-6V49-42GF on our website for more details including interactive diagrams and full exploit analysis.