A remote client can trigger an index-out-of-bounds panic in gRPC-Go servers created with xds.NewGRPCServer() prior to 1.82.2 and 1.83.2, which terminates the server process. The request can be unauthenticated in insecure or ordinary TLS deployments. This issue affects gRPC-Go servers with specific configurations, allowing an attacker to cause a denial-of-service condition. Defenders should assess exposure [truncated]
CVE-2026-48068 is a HIGH severity vulnerability in @grpc/grpc-js. An invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. The vulnerability affects users of @grpc/grpc-js, especially those who handle HTTP/2 streams. The issue has been publicly disclosed and patched, an [truncated]
