gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4270-1 advisory.

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260264).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272118).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address critical option not enforced for non-public-key     auth callbacks (bsc#1278597)
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278597)
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278597).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279297).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279414).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278967).

    Changes for google-guest-agent:

    - Updated to version 20260903.01

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4272-1 advisory.

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header.
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272118).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address critical option not enforced for non-public-key     auth callbacks (bsc#1278597)
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278597)
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278597).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279297).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279414).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278967).

    Changes for google-guest-agent:

    - Updated to version 20260903.01

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4062-1 advisory.

    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1278269).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1278272).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1278267).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4206-1 advisory.

    Security issues fixed:

    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272128).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279304).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279201).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278987).

    Non security issue fixed:

    - re-enable stripping and debuginfo (bsc#1210938).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4178-1 advisory.

    Security issues fixed:

    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272128).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279304).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279201).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278987).

    Non security issue fixed:

    - re-enable stripping and debuginfo (bsc#1210938).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4175-1 advisory.

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276644).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1278270).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1278273).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1278688).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21834-1 advisory.

    Security issues fixed:

    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272128).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279304).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279201).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278987).

    Non security issue fixed:

    - re-enable stripping and debuginfo (bsc#1210938).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21841-1 advisory.

    Changes in hauler:

    - update vendor.tar to fix:

      * bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662:
        hauler: golang.org/x/crypto/ssh: authentication bypass and         deadlocks in the crypto/ssh library

    - update vendor.tar to fix:

      * bsc#1279416, CVE-2026-84304
      * bsc#1279296, CVE-2026-84303
      * bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via         crash due to missing ':authority' and 'Host' headers

    Update to 2.1.0 (bsc#1265425, CVE-2026-41888).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21843-1 advisory.

    Changes in cadvisor:

    update vendor.tar to fix:

      * bsc#1279044, CVE-2026-84445
      * bsc#1279224, CVE-2026-84304
      * bsc#1279320, CVE-2026-84303: cadvisor: google.golang.org/grpc:
        xDS RBAC HTTP filter implementation issue allows for bypass         of authorization policies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4125-1 advisory.

    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276733).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279330).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279223).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1279026).

    Changes for azure-storage-azcopy:

    - Update to 10.32.8

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21824-1 advisory.

    - CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
    - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238699).
    - CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong     scope during       DOM construction (bsc#1241838).
    - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML     documents       (bsc#1251495).
    - CVE-2025-47913: client process termination when receiving an unexpected message type in response to a     key listing or       (bsc#1253506).
    - CVE-2025-47914: non validated message size can cause a panic due to an out of bounds read (bsc#1253967).
    - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248946).
    - CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253784).
    - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when     processing specially       crafted input (bsc#1251689).
    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues       when parsing HTML files (bsc#1267176).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260295).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265799).
    - CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead     to a denial of       service (bsc#1262952).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262269).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266639).
    -     CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,       CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,       CVE-2026-46598: multiple issues in golang.org/x/crypto/ssh (bsc#1266179).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276687).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272064).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278621).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279315).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279234).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21801-1 advisory.

    - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that     outlive expired CA       certificates (bsc#1258543).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of     raw-length       headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).
    - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks     (bsc#1278702).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278624).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279390).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279395).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1279392).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory.

    Update to version 3.21.1:

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276644).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).
    - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload     (bsc#1271660).
    - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-     range panic       (bsc#1272402).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1278270).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1278273).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1278688).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1276514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores     each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can     consume disproportionate heap memory even when payload bytes remain within connection and stream flow-     control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust     process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is     enabled by default and can be controlled temporarily with     GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
    (CVE-2026-84304)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348727	SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:4270-1)	Nessus	SuSE Local Security Checks	Local	high
348725	SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:4272-1)	Nessus	SuSE Local Security Checks	Local	high
348410	SUSE SLES15 Security Update : terraform-provider-null (SUSE-SU-2026:4062-1)	Nessus	SuSE Local Security Checks	Local	high
346793	SUSE SLES15 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4206-1)	Nessus	SuSE Local Security Checks	Local	high
346225	SUSE SLES12 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4178-1)	Nessus	SuSE Local Security Checks	Local	high
346217	SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4175-1)	Nessus	SuSE Local Security Checks	Local	high
346194	openSUSE 16 Security Update : google-cloud-sap-agent (openSUSE-SU-2026:21834-1)	Nessus	SuSE Local Security Checks	Local	high
346192	openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21841-1)	Nessus	SuSE Local Security Checks	Local	high
346191	openSUSE 16 Security Update : cadvisor (openSUSE-SU-2026:21843-1)	Nessus	SuSE Local Security Checks	Local	high
345841	SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:4125-1)	Nessus	SuSE Local Security Checks	Local	high
344999	openSUSE 16: containerized-data-importer1.65-api / etc (openSUSE-SU-2026:21824-1)	Nessus	SuSE Local Security Checks	Local	high
344683	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21801-1)	Nessus	SuSE Local Security Checks	Local	high
344664	openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)	Nessus	SuSE Local Security Checks	Local	high
342345	Linux Distros Unpatched Vulnerability : CVE-2026-84304	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-84304

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high