gRPC-Go: HTTP/2 requests rejected when :authority or :path headers missing

Key Information Summary for the Vulnerability Vulnerability Overview Type: When a gRPC server processes HTTP/2 requests that are missing required headers such as or , it returns an HTTP 400 status code (Bad Request). Core Issue: When a client's HTTP/2 request lacks the header, the gRPC server should return a 400 status code, but the current implementation may not handle this correctly, resulting in the request being rejected or behaving unexpectedly. Affected Components Affected Components: , , , Affected Scenarios: - When an HTTP/2 request is missing the header, the server should return a 400 status code. - When a request lacks the header, the gRPC server should return a 400 status code, but the current implementation may not handle this correctly. - When a request lacks the header, the gRPC server should return a 400 status code, but the current implementation may not handle this correctly. Fix Details Fix Content: - In , return a 400 status code when a request is missing the header. - In , return a 400 status code when a request is missing the header. - In , add a test case to verify that the server returns a 400 status code when a request is missing the header. - In , add a test case to verify that the server returns a 400 status code when a request is missing the header. Proof of Concept (POC) Code ```go // test/server_test.go func (s testServerTransportStream) Method() string { return s.method } func (s testServerTransportStream) SetHeader(metadata.MD) error { return nil } func (s testServerTransportStream) SendHeader(metadata.MD) error { return nil } func (s testServerTransportStream) SendMsg(m interface{}) error { return nil } func (s testServerTransportStream) SetTrailer(metadata.MD) { s.trailer = m } func (s testServerTransportStream) Context() context.Context { return s.ctx } func (s testServerTransportStream) SendAndClose(m interface{}) error { s.sendMsg(m) s.close() return nil } func (s testServerTransportStream) CloseSend() error { s.close() return nil } func (s testServerTransportStream) ReceiveMsg(m interface{}) error { return s.recvMsg(m) } func (s testServerTransportStream) SetCompress(compress bool) { s.compress = compress }

Goal Reached Thanks to every supporter — we hit 100%!

gRPC-Go: HTTP/2 requests rejected when :authority or :path headers missing

More from this source