Upgrade google.golang.org/grpc from v1.76.0 to v1.79.3 to address a critical authorization bypass vulnerability

[Shubham7-1]

Security Fix: HTTP/2 :path Header Authorization Bypass

Upgrade google.golang.org/grpc from v1.76.0 to v1.79.3 to address a critical authorization bypass vulnerability (Github Official).

Vulnerability Details

Issue: gRPC-Go servers prior to v1.79.3 accepted HTTP/2 requests with malformed :path pseudo-headers (missing leading slash), which could bypass path-based authorization interceptors.

Impact:

• Affects gRPC servers using path-based authorization interceptors (including the official google.golang.org/grpc/authz package)
• Attackers could send raw HTTP/2 frames with non-canonical paths (e.g., Service/Method instead of /Service/Method)
• Authorization "deny" rules defined using canonical paths failed to match, allowing bypass if fallback "allow" rules existed

Root Cause: The gRPC server was too lenient in routing logic, accepting non-canonical paths but evaluating them against authorization policies that expected canonical paths.

Fix

v1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error before reaching authorization interceptors.