aquasecurity / aquasecurity/tracee

v0.24.1: Tracee gRPC server tries to marshal invalid UTF-8 in strings

Open
#5,292 3 comments 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

I'm attaching a `grpcurl` instance to the Tracee gRPC server (`tracee.v1beta1.TraceeService.StreamEvents` RPC) and I noticed `grpcurl` often dies with

```
ERROR:
Code: Internal
Message: grpc: error while marshaling: string field contains invalid UTF-8
```

I think Tracee gRPC server should implement more validation/sanitization of raw syscall arguments (like read/write buffers, paths, argv) that land into grpc string fields. Anything binary (ELF bytes, compressed data, UTF-16 paths, random memory) blows up marshaling...

## Output of `tracee version`:

```
v0.24.1
```

## Output of `uname -a`:

```
Linux agentbox 6.8.0-106-generic #106-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 6 07:58:08 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
```

## Additional details

Contributor guide

Open the contributing guide

Research direction

Start at the tracee.v1beta1.TraceeService.StreamEvents gRPC entry point and reproduce with grpcurl using events containing raw syscall arguments such as buffers, paths, or argv. Trace which values reach string fields, define handling for invalid UTF-8, and verify grpcurl no longer fails while preserving valid text.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, grpc
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.