GHSA-xr7q-jx4m-x55m
Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go
GHSA-xr7q-jx4m-x55m is a vulnerability with no CVSS score yet in google.golang.org/grpc, published July 5, 2024. No source lists public exploit code. Fixed in google.golang.org/grpc 1.64.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.64.1google.golang.org/grpc
Description
Impact
This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.
Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0
Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
google.golang.org/grpcGo | 1.64.0 up to 1.64.1 | 1.64.1 |
What each source reports
GitHub AdvisoriesNo score
Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go
Impact
This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.
Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0
Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
- Record
GHSA-xr7q-jx4m-x55m- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go
Impact
This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.
Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0
Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
- Record
GHSA-xr7q-jx4m-x55m- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGO-2024-2978No score
Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc
If applications print or log a context containing gRPC metadata, the output will contain all the metadata, which may include private information. This represents a potential PII concern.
- Record
GO-2024-2978- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.