CVE-2026-84303

The record

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

Affected packages

Related vulnerabilities

• CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. CWE-178
• CVE-2026-87876 Two case-insensitive comparisons on request-derived usernames outside the main… CWE-178
• CVE-2026-84428 fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names… CWE-178
• CVE-2026-83612 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and… CWE-178
• CVE-2026-73270 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a… CWE-178
• CVE-2026-82726 Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote… CWE-178
• CVE-2026-78959 Improper handling of case sensitivity in FileSystem in Google Chrome prior to… CWE-178
• CVE-2026-62673 Grav is a file-based Web platform. CWE-178