Insecure default header matcher

Bug Report

We recently had a very serious CVE in our project https://docs.velociraptor.app/announcements/advisories/cve-2026-18972/ due to the default header matcher in grpc gateway.

The default header matcher copies all HTTP headers into the grpc metadata without filtering, allowing arbitrary metadata items to be added unexpectedly. If the user of grpc gateway does not set a specific header matcher with runtime.WithIncomingHeaderMatcher() option this can pollute the metadata with unexpected values injected by the http header.

I think a better more secure design is a noop header matcher which requires deliberately accepting some headers to be forwarded to the metadata. (i.e. opt in rather than opt out). If the user is trying to capture specific headers then they should declare those specific headers to be injected into the grpc metadata.

To Reproduce

The default runtime.NewServeMux( ) installs a default header matcher which copies all headers to the grpc metadata.

Expected behavior

If a new user does not carefully review all documentation they would expect the grpc metadata to be clean and free for spurious values.

Actual Behavior

In the default configuration, grpc metadata items can be injected by external HTTP headers.

Your Environment

All supported Go versions and OSs.