GO-2024-2978

    Dashboard / Vulnerabilities / GO-2024-2978

    GO-2024-2978

    Published: 9 Jul 2024Last Modified: 4 Feb 2026

    Summary: Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc

    Details: If applications print or log a context containing gRPC metadata, the output will contain all the metadata, which may include private information. This represents a potential PII concern.

    References: https://github.com/grpc/grpc-go/security/advisories/GHSA-xr7q-jx4m-x55m, https://github.com/grpc/grpc-go/commit/ab292411ddc0f3b7a7786754d1fe05264c3021eb

    Affected packages

    Package

    Name: google.golang.org/grpc

    Purl: pkg:golang/google.golang.org/grpc

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 1.64.0
    Fixed -1.64.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2024-2978 | CVE-DB