CVE-2026-84303: CWE-178: Improper Handling of Case Sensitivity in grpc grpc-go
Description
CVE-2026-84303 is a medium severity vulnerability in grpc-go prior to version 1.83.1. It involves improper handling of case sensitivity in the xDS RBAC HTTP filter, causing header matcher names not to be lowercased as expected. This leads to DENY policies with mixed-case header names failing to match and thus failing open, allowing unauthorized requests. Additionally, certain headers like :Scheme, Grpc-Status, and Host are improperly handled, affecting validation and rewriting. The issue is fixed in grpc-go version 1.83.1.
CVSS v4.0
Score 6.3medium
Affected software
grpc
grpc-go
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The grpc-go implementation of gRPC had a flaw in the xDS RBAC HTTP filter where header matcher names were not normalized to lowercase, despite incoming metadata keys being lowercase. This mismatch caused DENY policies using mixed-case header names to fail to match, resulting in requests that should be denied being allowed. Furthermore, this case sensitivity issue allowed headers such as :Scheme and Grpc-Status to bypass gRFC A41 validation and prevented the Host header from being rewritten to :authority as intended. The vulnerability is addressed in grpc-go version 1.83.1.
Potential Impact
Requests that should be denied by RBAC policies may be allowed due to case sensitivity mismatches in header matching, potentially permitting unauthorized access. Additionally, evasion of gRFC A41 validation and failure to rewrite the Host header could affect protocol compliance and security controls relying on these headers. There is no evidence of active exploitation in the wild.
Mitigation Recommendations
Upgrade grpc-go to version 1.83.1 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T16:17:43.078Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9717f4acd9273b490b16a8
Added to database: 09/01/2026, 18:22:44 UTC
Last enriched: 09/17/2026, 02:50:01 UTC
Last updated: 10/16/2026, 06:48:19 UTC
Views: 141
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.