Codestin Search App

easwars · 2026-08-19T05:53:51Z

The RBAC filter passes the name of a header matcher to the matching engine unchanged. The metadata that the engine matches against always has lowercase keys. A name that contains an uppercase character therefore matches no header, and the rule that holds it never fires. The policy parses, reports no error and looks active. A DENY policy written this way fails open.

The A41 validation reads the same unnormalized name, so the rejection of :scheme and grpc- prefixed matchers misses the name Grpc-Status. A Host matcher also keeps its name, although A41 makes host and :authority equivalent.

Lowercase the name in normalizeHeaderMatcher. That function already owns the A41 rules and already rewrites the name in place, so the matching engine, the :scheme and grpc- rejection, and the host alias all read one normalized name. Envoy holds each header matcher name in a LowerCaseString, grpc-java lowercases the name before it looks the header up, and authz/rbac_translator.go lowercases the name on the non-xDS path.

The new test in test/xds shows the effect on an end user. A DENY policy on the header name User-Agent returns OK for every RPC before the change and PermissionDenied after it. The unit tests cover the name that the parse gives to the engine, the case of the :scheme and grpc- rejection, and the host alias, at the top level and inside a nested rule.

RELEASE NOTES:

xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open.
xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase.
xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority.

The RBAC filter passes the name of a header matcher to the matching engine unchanged. The metadata that the engine matches against always has lowercase keys. A name that contains an uppercase character therefore matches no header, and the rule that holds it never fires. The policy parses, reports no error and looks active. A DENY policy written this way fails open. The A41 validation reads the same unnormalized name, so the rejection of :scheme and grpc- prefixed matchers misses the name Grpc-Status. A Host matcher also keeps its name, although A41 makes host and :authority equivalent. Lowercase the name in normalizeHeaderMatcher. That function already owns the A41 rules and already rewrites the name in place, so the matching engine, the :scheme and grpc- rejection, and the host alias all read one normalized name. Envoy holds each header matcher name in a LowerCaseString, grpc-java lowercases the name before it looks the header up, and authz/rbac_translator.go lowercases the name on the non-xDS path. The new test in test/xds shows the effect on an end user. A DENY policy on the header name User-Agent returns OK for every RPC before the change and PermissionDenied after it. The unit tests cover the name that the parse gives to the engine, the case of the :scheme and grpc- rejection, and the host alias, at the top level and inside a nested rule. RELEASE NOTES: - xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. - xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. - xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. Co-authored-by: Markus Magnuson <[email protected]>

arjan-bal

LGTM

codecov · 2026-08-19T05:58:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.16%. Comparing base (c92e985) to head (ba7d09c).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9332      +/-   ##
==========================================
+ Coverage   83.07%   83.16%   +0.08%     
==========================================
  Files         423      423              
  Lines       35233    35236       +3     
==========================================
+ Hits        29270    29303      +33     
+ Misses       4449     4429      -20     
+ Partials     1514     1504      -10

Files with missing lines	Coverage Δ
internal/xds/httpfilter/rbac/rbac.go	`74.07% <100.00%> (+0.74%)`	⬆️

... and 27 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The RBAC filter passes the name of a header matcher to the matching engine unchanged. The metadata that the engine matches against always has lowercase keys. A name that contains an uppercase character therefore matches no header, and the rule that holds it never fires. The policy parses, reports no error and looks active. A DENY policy written this way fails open. The A41 validation reads the same unnormalized name, so the rejection of :scheme and grpc- prefixed matchers misses the name Grpc-Status. A Host matcher also keeps its name, although A41 makes host and :authority equivalent. Lowercase the name in normalizeHeaderMatcher. That function already owns the A41 rules and already rewrites the name in place, so the matching engine, the :scheme and grpc- rejection, and the host alias all read one normalized name. Envoy holds each header matcher name in a LowerCaseString, grpc-java lowercases the name before it looks the header up, and authz/rbac_translator.go lowercases the name on the non-xDS path. The new test in test/xds shows the effect on an end user. A DENY policy on the header name User-Agent returns OK for every RPC before the change and PermissionDenied after it. The unit tests cover the name that the parse gives to the engine, the case of the :scheme and grpc- rejection, and the host alias, at the top level and inside a nested rule. RELEASE NOTES: - xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. - xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. - xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. Co-authored-by: Markus Magnuson <[email protected]> (cherry picked from commit db94828)

Original PRs: #9258 and #9332 RELEASE NOTES: - xds/rbac: Fix a bug where nested `Principal` or `Permission` rules with `:scheme` or `grpc-` prefixed header matchers were not rejected, which could cause DENY rules to fail open. - xds/rbac: Fix a bug where the `host` header matcher was not being replaced with `:authority` in nested `Principal` or `Permission` rules. - xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. - xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. - xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. --------- Co-authored-by: Naveed <[email protected]> Co-authored-by: Markus Magnuson <[email protected]>

The RBAC filter passes the name of a header matcher to the matching engine unchanged. The metadata that the engine matches against always has lowercase keys. A name that contains an uppercase character therefore matches no header, and the rule that holds it never fires. The policy parses, reports no error and looks active. A DENY policy written this way fails open. The A41 validation reads the same unnormalized name, so the rejection of :scheme and grpc- prefixed matchers misses the name Grpc-Status. A Host matcher also keeps its name, although A41 makes host and :authority equivalent. Lowercase the name in normalizeHeaderMatcher. That function already owns the A41 rules and already rewrites the name in place, so the matching engine, the :scheme and grpc- rejection, and the host alias all read one normalized name. Envoy holds each header matcher name in a LowerCaseString, grpc-java lowercases the name before it looks the header up, and authz/rbac_translator.go lowercases the name on the non-xDS path. The new test in test/xds shows the effect on an end user. A DENY policy on the header name User-Agent returns OK for every RPC before the change and PermissionDenied after it. The unit tests cover the name that the parse gives to the engine, the case of the :scheme and grpc- rejection, and the host alias, at the top level and inside a nested rule. RELEASE NOTES: - xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. - xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. - xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. Co-authored-by: Markus Magnuson <[email protected]> (cherry picked from commit db94828)

Original PR: #9332 RELEASE NOTES: none Co-authored-by: Markus Magnuson <[email protected]>

…(#83) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.82.0` → `v1.83.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.83.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.82.0/v1.83.1?slim=true) | --- ### Release Notes <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.83.1`](https://github.com/grpc/grpc-go/releases/tag/v1.83.1): Release 1.83.1 [Compare Source](grpc/grpc-go@v1.83.0...v1.83.1) ### Security - xds/rbac: Fix a bug where nested `Principal` or `Permission` rules with `:scheme` or `grpc-` prefixed header matchers were not rejected, which could cause DENY rules to fail open. ([#9258](grpc/grpc-go#9258)) - Special Thanks: [@nvxbug](https://github.com/nvxbug) - xds/rbac: Fix a bug where the `host` header matcher was not being replaced with `:authority` in nested `Principal` or `Permission` rules. ([#9258](grpc/grpc-go#9258)) - Special Thanks: [@nvxbug](https://github.com/nvxbug) - xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. ([#9332](grpc/grpc-go#9332)) - Special Thanks: [@alimony](https://github.com/alimony) - xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. ([#9332](grpc/grpc-go#9332)) - Special Thanks: [@alimony](https://github.com/alimony) - xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. ([#9332](grpc/grpc-go#9332)) - Special Thanks: [@alimony](https://github.com/alimony) ### Performance - transport: Restrict memory overhead of buffering small data frames. ([#9331](grpc/grpc-go#9331)) ### [`v1.83.0`](https://github.com/grpc/grpc-go/releases/tag/v1.83.0): Release 1.83.0 [Compare Source](grpc/grpc-go@v1.82.1...v1.83.0) ### Security - server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable `GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT`. - xds/rbac: Support `Metadata` and `RequestedServerName` permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open. - xds/rbac: Fix panic when parsing unsupported fields in `NotRule`/`NotId` permissions. - xds/rbac: Support the deprecated `source_ip` principal identifier by treating it as equivalent to `direct_remote_ip`. - xds: Fix panic when parsing route header matchers configured with empty `exact_match`, `prefix_match`, or `suffix_match` strings. ([#9223](grpc/grpc-go#9223)) ### New Features - xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the `force-xds` target URI query parameter. ([#9133](grpc/grpc-go#9133)) - xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. ([#9145](grpc/grpc-go#9145)) - authz: Add `OnPolicyUpdate` callback to `FileWatcherOptions` to notify when an authz policy is loaded or updated. ([#9142](grpc/grpc-go#9142)) - Special Thanks: [@hnefatl](https://github.com/hnefatl) - xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs. - This feature can be enabled by setting environment variable `GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true`. ([#9119](grpc/grpc-go#9119)) - xds: Add support for xDS-based HTTP CONNECT proxies. - This feature can be enabled by setting environment variable `GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true`. ([#9151](grpc/grpc-go#9151)) - xds: Add support for `contains_match` in route header matchers. ([#9223](grpc/grpc-go#9223)) ### Bug Fixes - credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. ([#9197](grpc/grpc-go#9197)) - grpc: Fix compilation on Plan 9 targets (`GOOS=plan9`), broken since v1.81.0. ([#9255](grpc/grpc-go#9255)) - Special Thanks: [@Yusufihsangorgel](https://github.com/Yusufihsangorgel) ### [`v1.82.1`](https://github.com/grpc/grpc-go/releases/tag/v1.82.1): Release 1.82.1 [Compare Source](grpc/grpc-go@v1.82.0...v1.82.1) ### Security - server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable `GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT`. - xds/rbac: Support `Metadata` and `RequestedServerName` permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open. - xds/rbac: Fix panic when parsing unsupported fields in `NotRule`/`NotId` permissions. - xds/rbac: Support the deprecated `source_ip` principal identifier by treating it as equivalent to `direct_remote_ip`. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/runner-k8s-plugin/pulls/83

Fixes #9352 xDS RDS route header matchers store the header name verbatim from the config in `routesProtoToSlice`: ```go header.Name = h.GetName() ``` The matcher engine looks that name up against `metadata.MD`, whose keys are always lowercase, so a matcher configured with a mixed-case name such as `X-Role` matches no header and the route never fires. This is the last consumer of that matcher engine that does not normalize the name. The RBAC HTTP filter started lowercasing it at parse time in #9332 (`normalizeHeaderMatcher`), and `authz/rbac_translator.go` does the same on the non-xDS path. Envoy stores `HeaderMatcher.name` in a `Http::LowerCaseString`, so this is valid config that works on other proxies. The fix lowercases the name where the route header matcher is built, matching the sibling paths. Added a table test covering a mixed-case name against lowercased metadata, and asserting the parsed matcher stores the lowercased name; it fails on `master` and passes with the change. RELEASE NOTES: * xds: fix RDS route header matchers with non-lowercase names never matching

…/forgejo) (#14216) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.82.1` → `v1.83.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.83.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.82.1/v1.83.1?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2779) for more information. --- ### gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) / [GHSA-vp52-pcj8-j9qc](GHSA-vp52-pcj8-j9qc) <details> <summary>More information</summary> #### Details ##### Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation. Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS). ##### Patches The change to fix this issue is merged in `master` and a patch release, 1.83.1, has been published that contains this fix. ##### Workarounds This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads. This behavior is enabled by default. A temporary escape hatch is provided via the environment variable `GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false` to disable the feature if unforeseen issues arise, but it will be removed in a future release. #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc) - [https://nvd.nist.gov/vuln/detail/CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [https://github.com/grpc/grpc-go/pull/9331](https://github.com/grpc/grpc-go/pull/9331) - [https://github.com/grpc/grpc-go/pull/9333](https://github.com/grpc/grpc-go/pull/9333) - [https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176](https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176) - [https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77](https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77) - [https://github.com/grpc/grpc-go](https://github.com/grpc/grpc-go) - [https://github.com/grpc/grpc-go/releases/tag/v1.83.1](https://github.com/grpc/grpc-go/releases/tag/v1.83.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-vp52-pcj8-j9qc) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.83.1`](https://github.com/grpc/grpc-go/releases/tag/v1.83.1): Release 1.83.1 [Compare Source](grpc/grpc-go@v1.83.0...v1.83.1) ### Security - xds/rbac: Fix a bug where nested `Principal` or `Permission` rules with `:scheme` or `grpc-` prefixed header matchers were not rejected, which could cause DENY rules to fail open. ([#9258](grpc/grpc-go#9258)) - Special Thanks: [@nvxbug](https://github.com/nvxbug) - xds/rbac: Fix a bug where the `host` header matcher was not being replaced with `:authority` in nested `Principal` or `Permission` rules. ([#9258](grpc/grpc-go#9258)) - Special Thanks: [@nvxbug](https://github.com/nvxbug) - xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as `X-Role`, matched no header, which could cause DENY rules to fail open. ([#9332](grpc/grpc-go#9332)) - Special Thanks: [@alimony](https://github.com/alimony) - xds/rbac: Fix a bug where a `:scheme` or `grpc-` prefixed header matcher was accepted when its name was not lowercase. ([#9332](grpc/grpc-go#9332)) - Special Thanks: [@alimony](https://github.com/alimony) - xds/rbac: Fix a bug where a `Host` header matcher was not replaced with `:authority`. ([#9332](grpc/grpc-go#9332)) - Special Thanks: [@alimony](https://github.com/alimony) ### Performance - transport: Restrict memory overhead of buffering small data frames. ([#9331](grpc/grpc-go#9331)) ### [`v1.83.0`](https://github.com/grpc/grpc-go/releases/tag/v1.83.0): Release 1.83.0 [Compare Source](grpc/grpc-go@v1.82.2...v1.83.0) ### Security - server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable `GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT`. - xds/rbac: Support `Metadata` and `RequestedServerName` permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open. - xds/rbac: Fix panic when parsing unsupported fields in `NotRule`/`NotId` permissions. - xds/rbac: Support the deprecated `source_ip` principal identifier by treating it as equivalent to `direct_remote_ip`. - xds: Fix panic when parsing route header matchers configured with empty `exact_match`, `prefix_match`, or `suffix_match` strings. ([#9223](grpc/grpc-go#9223)) ### New Features - xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the `force-xds` target URI query parameter. ([#9133](grpc/grpc-go#9133)) - xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. ([#9145](grpc/grpc-go#9145)) - authz: Add `OnPolicyUpdate` callback to `FileWatcherOptions` to notify when an authz policy is loaded or updated. ([#9142](grpc/grpc-go#9142)) - Special Thanks: [@hnefatl](https://github.com/hnefatl) - xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs. - This feature can be enabled by setting environment variable `GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true`. ([#9119](grpc/grpc-go#9119)) - xds: Add support for xDS-based HTTP CONNECT proxies. - This feature can be enabled by setting environment variable `GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true`. ([#9151](grpc/grpc-go#9151)) - xds: Add support for `contains_match` in route header matchers. ([#9223](grpc/grpc-go#9223)) ### Bug Fixes - credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. ([#9197](grpc/grpc-go#9197)) - grpc: Fix compilation on Plan 9 targets (`GOOS=plan9`), broken since v1.81.0. ([#9255](grpc/grpc-go#9255)) - Special Thanks: [@Yusufihsangorgel](https://github.com/Yusufihsangorgel) ### [`v1.82.2`](https://github.com/grpc/grpc-go/releases/tag/v1.82.2): Release 1.82.2 [Compare Source](grpc/grpc-go@v1.82.1...v1.82.2) ### Security - server: Reject requests missing both `:authority` and `Host` headers with HTTP 400 and status `Internal`. ([#9365](grpc/grpc-go#9365)) - Special Thanks: [@winklemad](https://github.com/winklemad) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14216 Reviewed-by: Mathieu Fenniak <[email protected]>

easwars requested a review from arjan-bal August 19, 2026 05:54

easwars assigned arjan-bal Aug 19, 2026

easwars added Type: Bug Type: Security A bug or other problem affecting security Area: xDS Includes everything xDS related, including LB policies used with xDS. labels Aug 19, 2026

easwars added this to the 1.84 Release milestone Aug 19, 2026

arjan-bal approved these changes Aug 19, 2026

View reviewed changes

arjan-bal assigned easwars and unassigned arjan-bal Aug 19, 2026

easwars merged commit db94828 into grpc:master Aug 19, 2026
19 of 23 checks passed

easwars deleted the xds_rbac_lowercase_header_matchers branch August 19, 2026 06:02

easwars mentioned this pull request Aug 19, 2026

Cherry-pick #9258 and #9332 into v1.83.x #9335

Merged

easwars mentioned this pull request Aug 19, 2026

Cherry-pick #9332 to v1.84.x #9338

Merged

easwars added a commit that referenced this pull request Aug 19, 2026

Cherry-pick #9332 to v1.84.x (#9338)

8a9f866

Original PR: #9332 RELEASE NOTES: none Co-authored-by: Markus Magnuson <[email protected]>

This was referenced Aug 23, 2026

xds: RDS route header matchers with non-lowercase names never match #9352

Closed

xds: lowercase RDS route header matcher names before matching #9353

Merged

easwars mentioned this pull request Sep 1, 2026

Unify the header matcher implementations across RBAC filters and RDS #9387

Open

Effi-S mentioned this pull request Sep 2, 2026

ci: Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /cmd/tokengen LFDT-Panurus/panurus#2346

Merged

GoVulnBot mentioned this pull request Sep 8, 2026

x/vulndb: potential Go vuln in google.golang.org/grpc: GHSA-qc2q-p7wx-3px3 golang/vulndb#6441

Open

Navigation Menu

Uh oh!

xds/rbac: lowercase header matcher names before matching - #9332

xds/rbac: lowercase header matcher names before matching#9332
easwars merged 1 commit into
grpc:masterfrom
easwars:xds_rbac_lowercase_header_matchers

easwars commented Aug 19, 2026

Uh oh!

arjan-bal left a comment

Uh oh!

codecov Bot commented Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

easwars commented Aug 19, 2026

Uh oh!

arjan-bal left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Aug 19, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants