Bug 2522863

Summary: coredns__release-4.16: google.golang.org/grpc v1.63.2: authorization bypass via missing leading / in :path (GO-2026-4762 / GHSA-qqhg-vw7x-wr2j)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agarcial, akhatavk, aoconnor, aos-team-art-private, asdas, asegurap, dpaolell, gparvin, jbalunas, jburrell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhaigner, security-response-team, sghai, sidsharm, suppawar, tsze, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 19:13:47 UTC 
## google.golang.org/grpc v1.57.0 — HTTP/2 rapid-reset DoS (GHSA-m425-mq94-257g) reachable via gRPC listener

**CWEs:** CWE-400
**CVSS:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
**Component:** openshift-4.16-payload/coredns__release-4.16

### Description
google.golang.org/grpc is pinned at v1.57.0, which lacks the MaxConcurrentStreams enforcement fix for the HTTP/2 rapid-reset attack (CVE-2023-44487 / GHSA-m425-mq94-257g, fixed in 1.57.1/1.58.3). CoreDNS exposes a native gRPC DNS transport (ServergRPC.Serve calls grpc.NewServer().Serve(l)) when a grpc:// listener block is configured. An attacker on the pod network can open and immediately reset large numbers of streams to drive unbounded goroutine and memory growth in the DNS pod.

### Affected Locations
- `:`
- `:`

### Evidence
**go.mod:34**
```go
google.golang.org/grpc v1.57.0
```

### Attack Pattern
Pod-network client reaching the grpc:// DNS port → unauthenticated memory/CPU exhaustion of cluster DNS.

---
*Source: Ex-Wing security assessment, finding FIND-002*