Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

grpc/grpc-go

              master @ d74861e
            

Fixes

CVEs

CRITICAL

Peak severity

36.4%

Coverage

Highlights

Denial of Service: 14 prior fixes. Scrutinize any change in this area.

internal/xds/rbac: most-fixed (4 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass path-based routing and authorization checks by sending requests with malformed or non-canonical HTTP/2 :path pseudo-headers that lack a leading slash. This vulnerability (CVE-2026-33186) was addressed by removing fallback variables and enforcing strict, unconditional path checks on the server.

Auth Bypass: Failures or parsing errors during RBAC evaluation—such as malformed IP address patterns or invalid regex formats—previously failed-open instead of failing-closed, letting unauthorized traffic bypass security policies. Strict fail-closed semantics and robust validation of IP-based and regex rules must be maintained.

Denial of Service: Unbounded transport-level memory and resource consumption can occur when parsing extremely large HTTP/2 headers or encountering protocol-level stream issues. Restricting the default maximum header list size and implementing proper early stream abortion mitigates memory exhaustion vectors.