The grpc-go library contains three main security issues: (1) The xDS RBAC authorization engine silently ignores unsupported matchers like Metadata and RequestedServerName, causing authorization policies relying solely on these to fail open and allow unauthorized access. Nested NOT or complex logical rules exacerbate this logic flaw. (2) The HTTP/2 transport server's rapid reset mitigation only accounted for control frames that generate responses, allowing an attacker to flood the server with client-initiated stream resets (HEADERS followed by RST_STREAM) to bypass rate limits and cause high CPU usage, resulting in denial of service. (3) The xDS RBAC engine panics when processing NOT rules wrapping unsupported fields such as SourcedMetadata, leading to server crashes. These vulnerabilities have been addressed in the grpc-go master branch and will be released in version 1.82.1.

The authorization bypass vulnerability can allow unauthorized clients to access protected gRPC services if RBAC policies rely on unsupported matchers, effectively removing intended access restrictions. The HTTP/2 rapid reset mitigation bypass enables attackers to cause high CPU consumption and denial of service by flooding the server with rapid stream resets. The server panic vulnerability can cause immediate process crashes when receiving malicious or misconfigured xDS RBAC policies with unsupported NOT rules, resulting in denial of service. These impacts affect grpc-go servers running vulnerable versions prior to 1.82.1.

A fix is available in grpc-go version 1.82.1; users should upgrade to this version once released. Until then, for the xDS RBAC vulnerabilities and panics, ensure upstream xDS management servers do not push RBAC policies containing Metadata, RequestedServerName, or NOT rules wrapping unsupported fields like SourcedMetadata. For the HTTP/2 rapid reset denial of service, configure upstream reverse proxies or load balancers (e.g., Envoy) to enforce strict HTTP/2 max_concurrent_streams limits and rate limit RST_STREAM frames per connection. These mitigations reduce exposure until the official patch is applied.