---
id: CVE-2026-84303
title: gRPC-Go is the Go language implementation of gRPC
summary: >-
  gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS
  RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase
  header matcher names in normalizeHeaderMatcher even though incoming metadata
  keys are…
severity: medium
cwe:
  - CWE-178
  - CWE-863
vendor: grpc
product: google.golang.org/grpc
affected:
  - google.golang.org/grpc < 1.83.1
patched:
  - google.golang.org/grpc 1.83.1
published: '2026-09-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84303'
references:
  - url: >-
      https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8
    label: security-advisories@github.com
  - url: >-
      https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/pull/9332'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/pull/9335'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/releases/tag/v1.83.1'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84303'
  - url: 'https://github.com/grpc/grpc-go'
  - url: 'https://github.com/advisories/GHSA-qc2q-p7wx-3px3'
tags:
  - nvd
  - osv
  - go
  - ghsa
epss: 0.00311
epssPercentile: 0.24118
aliases:
  - GHSA-qc2q-p7wx-3px3
  - GO-2026-6441
ecosystem: go
ingestedAt: '2026-09-08T21:11:12.322Z'
---

## Overview

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84303)

Affected packages:

- `google.golang.org/grpc < 1.83.1`

Patched in:

- `google.golang.org/grpc 1.83.1`

Source: https://osv.dev/vulnerability/GHSA-qc2q-p7wx-3px3