grpc grpc-go

• CVE-2026-84445 High 8.7 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers 0.6%
• CVE-2026-84304 High 8.7 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation 0.6%
• CVE-2026-84303 Medium 6.3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion 0.3%
• CVE-2026-33186 Critical 9.1 gRPC-Go has an authorization bypass via missing leading slash in :path 1.6%