~ / search / GHSA-37w2-q6vh-45v6

GHSA-37w2-q6vh-45v6

Spring gRPC AuthenticationException messages are reflected to remote client

Source: GitHub Advisory Database (reviewed) Low CVE-2026-40969

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.grpc:spring-grpc < 1.0.3 1.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

References

External links from the advisory. They lead to third-party sites.