{"id":"GHSA-xr7q-jx4m-x55m","aliases":["GO-2024-2978"],"status":"published","title":"Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go","description":"### Impact\nThis issue represents a potential PII concern.  If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.\n\n### Patches\nThe issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0\n\n### Workarounds\nIf using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-07-05T20:07:01Z","modified":"2026-09-10T03:50:17Z","fixes":[{"ecosystem":"Go","package":"google.golang.org/grpc","fixed_in":["1.64.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"google.golang.org/grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.64.0"},{"fixed":"1.64.1"}]}]},{"source":"osv","ecosystem":"Go","package":"google.golang.org/grpc","ranges":[{"type":"SEMVER","events":[{"introduced":"1.64.0"},{"fixed":"1.64.1"}]}]},{"source":"osv","ecosystem":"Go","package":"google.golang.org/grpc","ranges":[{"type":"SEMVER","events":[{"introduced":"1.64.0"},{"fixed":"1.64.1"}]}]}],"references":[{"url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-xr7q-jx4m-x55m","tags":["web","advisory"]},{"url":"https://github.com/grpc/grpc-go/commit/ab292411ddc0f3b7a7786754d1fe05264c3021eb","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-xr7q-jx4m-x55m"},{"url":"https://github.com/grpc/grpc-go","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-xr7q-jx4m-x55m","title":"Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go","description":"### Impact\nThis issue represents a potential PII concern.  If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.\n\n### Patches\nThe issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0\n\n### Workarounds\nIf using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.\n","status":"published","published":"2024-07-05T20:07:01Z","modified":"2024-07-09T21:38:29Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:56.530214Z"}],"osv":[{"id":"GHSA-xr7q-jx4m-x55m","title":"Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go","description":"### Impact\nThis issue represents a potential PII concern.  If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.\n\n### Patches\nThe issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0\n\n### Workarounds\nIf using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.\n","status":"published","published":"2024-07-05T20:07:01Z","modified":"2026-09-10T03:50:17.144982671Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"GO-2024-2978","title":"Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc","description":"If applications print or log a context containing gRPC metadata, the output will contain all the metadata, which may include private information. This represents a potential PII concern.","status":"published","published":"2024-07-09T16:55:06Z","modified":"2026-02-04T04:40:42.328334Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}