AIKIDO-2026-262374
grpcio is vulnerable to Use After Free
65
Medium Risk
This Affects:
grpcioTL;DR
The gRPC Core xDS client keeps a global map from client keys to GrpcXdsClient instances. When an entry's refcount reaches zero and GetOrCreate() replaces the client, insert_or_assign() could update the map value without refreshing the absl::string_view key that still pointed into the freed object. Subsequent lookups then use a dangling key and can trigger a use-after-free crash. The fix erases zero-refcount entries before emplacing a new client and adds regression tests for the map key lifetime.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment uses gRPC xDS (for example xDS resolver targets or xDS bootstrap configuration).
Background info
grpcio is vulnerable to Use After Free in versions 1.81.0 - 1.81.0.
How to fix this
Upgrade the grpcio library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant