Go Vulnerability Database

• CVE-2026-84445, GHSA-2v4p-qf9q-27wj
• Affects: google.golang.org/grpc
• Published: Sep 15, 2026

In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.

• CVE-2026-84303, GHSA-qc2q-p7wx-3px3
• Affects: google.golang.org/grpc
• Published: Sep 15, 2026

In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing.

• CVE-2026-73087, GHSA-p2w3-6x73-2f6x
• Affects: github.com/amir20/dozzle
• Published: Sep 10, 2026
• Unreviewed

Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher in github.com/amir20/dozzle

• CVE-2026-71493, GHSA-mmg6-4qmv-6pc8
• Affects: github.com/infracost/infracost
• Published: Sep 10, 2026
• Unreviewed

Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost

• CVE-2026-71494, GHSA-6x6c-w9w9-hv4h
• Affects: github.com/infracost/infracost
• Published: Sep 10, 2026
• Unreviewed

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname in github.com/infracost/infracost