CVE-2026-84445
published 2026-09-14CVE-2026-84445: gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow…
PriorityP354high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.64%
50.4th percentile
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
Affected
983 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | 3scale-operator-bundle | — | — |
| 3scale-amp2 | 3scale-rhel7-operator-metadata | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| advanced-cluster-security | rhacs-operator-bundle | — | — |
| advanced-cluster-security | rhacs-rhel8-operator | — | — |
| advanced-cluster-security | rhacs-rhel9-operator | — | — |
| advanced-cluster-security | rhacs-roxctl-rhel8 | — | — |
| advanced-cluster-security | rhacs-roxctl-rhel9 | — | — |
| advanced-cluster-security | rhacs-scanner-rhel8 | — | — |
| advanced-cluster-security | rhacs-scanner-rhel9 | — | — |
| advanced-cluster-security | rhacs-scanner-slim-rhel8 | — | — |
| advanced-cluster-security | rhacs-scanner-slim-rhel9 | — | — |
| advanced-cluster-security | rhacs-scanner-v4-rhel8 | — | — |
| advanced-cluster-security | rhacs-scanner-v4-rhel9 | — | — |
| agent-sandbox | agent-sandbox-rhel9-operator | — | — |
| albo | aws-load-balancer-controller-rhel8 | — | — |
| ansible-automation-platform-24 | aap-must-gather-rhel8 | — | — |
| ansible-automation-platform-24 | controller-rhel8-operator | — | — |
| ansible-automation-platform-24 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-24 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-24 | hub-rhel8-operator | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8-operator | — | — |
| ansible-automation-platform-24 | platform-resource-rhel8-operator | — | — |
| ansible-automation-platform-25 | controller-rhel8-operator | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
vendor_redhat·2026-09-14·CVSS 8.7
CVE-2026-84445 [HIGH] CWE-125 google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before t
VulDB
gRPC-Go prior 1.82.2/1.83.2 xDS Routing Interceptor out-of-bounds (Nessus ID 345841)
vuldb·2026-09-15·CVSS 8.7
CVE-2026-84445 [HIGH] gRPC-Go prior 1.82.2/1.83.2 xDS Routing Interceptor out-of-bounds (Nessus ID 345841)
A vulnerability classified as problematic was found in gRPC-Go. This issue affects some unknown processing of the component xDS Routing Interceptor. Executing a manipulation can lead to out-of-bounds read.
This vulnerability appears as CVE-2026-84445. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
GHSA
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
ghsa·2026-09-08
CVE-2026-84445 [HIGH] CWE-129 gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS).
Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from
No detection rules found.
No public exploits indexed.
https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297fhttps://github.com/grpc/grpc-go/issues/9354https://github.com/grpc/grpc-go/pull/9365https://github.com/grpc/grpc-go/pull/9366https://github.com/grpc/grpc-go/pull/9367https://github.com/grpc/grpc-go/releases/tag/v1.82.2https://github.com/grpc/grpc-go/releases/tag/v1.83.2https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
2026-09-14
Published