G
Vendor security profile
grpc
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical2
CISA KEV0
Public exploit3
Patch rate%55
Avg. CVSS7.6
12-month vulnerability rate
0
0
0
0
1
0
0
3
0
1
6
0
CVE KEV
CVE severity distribution
11toplam CVE
Critical2 (18%)
High6 (55%)
Medium2 (18%)
Low1 (9%)
Patch and exploitation view
%55
Verified patch
%0
CISA KEV
%27
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
7.4
CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
G
Patch status unknownEPSS %0
3.7
CVE-2026-101915
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
G
Patch status unknownEPSS %0
6.5
CVE-2026-101914
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
G
Patch status unknownEPSS %0
8.7
CVE-2026-84445
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
G
Patch verifiedEPSS %1
8.7
CVE-2026-84304
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
G
Patch status unknownEPSS %1
6.3
CVE-2026-84303
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
G
Patch verifiedEPSS %0
9.2
CVE-2026-48853
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
E
Patch verifiedEPSS %1
7.6
CVE-2026-48599
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding
E
Patch verifiedEPSS %0
8.7
CVE-2026-48854
Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc
E
Patch verifiedEPSS %0
9.1
CVE-2026-33186
gRPC-Go has an authorization bypass via missing leading slash in :path
G
Patch status unknownEPSS %2