GoPackage

google.golang.org/grpc

4 known vulnerabilities (1 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v1.85.0 (Oct 27, 2026): no advisory affects it
Newest unaffected release: v1.85.0 (Oct 27, 2026), the latest release
Advisories: 4 · 1 critical, 2 high, 1 medium

Releases: 249 since v1.0.0 (Jul 11, 2016)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-84445
Affects v1.0.0 to v1.82.1 (v1.82.2 is outside it); v1.83.0 to v1.83.1 (v1.83.2 is outside it); v1.84.0-dev (v1.84.0 is outside it); v1.85.0-dev (v1.85.0 is outside it)
CVE-2026-84304
Affects v1.0.0 to v1.83.0 (v1.83.1 is outside it)
CVE-2026-84303
Affects v1.0.0 to v1.83.0 (v1.83.1 is outside it)
CVE-2026-33186
Affects v1.0.0 to v1.79.2 (v1.79.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

CVE-2026-84445High 8.7
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Affected: fixed in 1.82.2; from 1.83.0, fixed in 1.83.2; from 1.84.0-dev, fixed in 1.84.0-dev.0.20260825144003-d5a41119e0e3; from 1.85.0-dev, fixed in 1.85.0-dev.0.20260825072537-93e31b48545e; fixed in 1.82.2; from 1.83.0, fixed in 1.83.2; from 1.84.0-dev, fixed in 1.84.0-dev.0.20260825144003-d5a41119e0e3; from 1.85.0-dev, fixed in 1.85.0-dev.0.20260825072537-93e31b48545e.
Fixed in v1.82.2 (released Aug 25, 2026, 20 days before disclosure), v1.83.2 (released Aug 25, 2026, 20 days before disclosure), v1.84.0 (released Sep 17, 2026, 3 days after disclosure, the advisory names 1.84.0-dev.0.20260825144003-d5a41119e0e3, which was never published) and 1 other version.
The latest release, v1.85.0, is not affected.
CVE-2026-84304High 8.7
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
Affected: fixed in 1.83.1.
Fixed in v1.83.1 (released Aug 19, 2026, 13 days before disclosure).
The latest release, v1.85.0, is not affected.
CVE-2026-84303Medium 6.3
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Affected: fixed in 1.83.1.
Fixed in v1.83.1 (released Aug 19, 2026, 13 days before disclosure).
The latest release, v1.85.0, is not affected.
CVE-2026-33186Critical 9.1
gRPC-Go has an authorization bypass via missing leading slash in :path
Affected: fixed in 1.79.3.
Fixed in v1.79.3 (released Mar 17, 2026, 3 days before disclosure).
The latest release, v1.85.0, is not affected.