Ggrpc

Products

Exploited and recent CVEs

• CVE-2026-101916 High 7.4 @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized 0.2%
• CVE-2026-101915 Low 3.7 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages 0.3%
• CVE-2026-101914 Medium 6.5 @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches 0.3%
• CVE-2026-84445 High 8.7 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers 0.6%
• CVE-2026-84304 High 8.7 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation 0.6%
• CVE-2026-84303 Medium 6.3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion 0.3%
• CVE-2026-48069 High 7.5 @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash 0.9%
• CVE-2026-48068 High 7.5 @grpc/grps-js: A malformed request can cause a server crash 0.9%
• CVE-2026-33186 Critical 9.1 gRPC-Go has an authorization bypass via missing leading slash in :path 1.6%
• CVE-2024-11407 Medium 6.9 Denial of Service through Data corruption in gRPC-C++ 0.6%
• CVE-2024-37168 Medium 5.3 @grpc/grpc-js can allocate memory for incoming messages well above configured limits 0.7%
• CVE-2022-24777 High 7.5 Denial of Service via reachable assertion in grpc-swift 1.2%