Bug 2522863 - coredns__release-4.16: google.golang.org/grpc v1.63.2: authorization bypass via missing leading / in :path (GO-2026-4762 / GHSA-qqhg-vw7x-wr2j)
Summary: coredns__release-4.16: google.golang.org/grpc v1.63.2: authorization bypass v...
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-24 19:13 UTC by OSIDB Bzimport
Modified: 2026-09-22 22:30 UTC (History)
24 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-24 19:13:47 UTC 
## google.golang.org/grpc v1.57.0 — HTTP/2 rapid-reset DoS (GHSA-m425-mq94-257g) reachable via gRPC listener

**CWEs:** CWE-400
**CVSS:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
**Component:** openshift-4.16-payload/coredns__release-4.16

### Description
google.golang.org/grpc is pinned at v1.57.0, which lacks the MaxConcurrentStreams enforcement fix for the HTTP/2 rapid-reset attack (CVE-2023-44487 / GHSA-m425-mq94-257g, fixed in 1.57.1/1.58.3). CoreDNS exposes a native gRPC DNS transport (ServergRPC.Serve calls grpc.NewServer().Serve(l)) when a grpc:// listener block is configured. An attacker on the pod network can open and immediately reset large numbers of streams to drive unbounded goroutine and memory growth in the DNS pod.

### Affected Locations
- `:`
- `:`

### Evidence
**go.mod:34**
```go
google.golang.org/grpc v1.57.0
```

### Attack Pattern
Pod-network client reaching the grpc:// DNS port → unauthenticated memory/CPU exhaustion of cluster DNS.

---
*Source: Ex-Wing security assessment, finding FIND-002*
Note You need to log in before you can comment on or make changes to this bug.