CVE-2026-84445
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
gRPC-Go prior to 1.82.2 and 1.83.2 allows servers created with xds.NewGRPCServer() to accept an RPC lacking both the :authority and Host headers. RouteAndProcess assumes an authority value exists and indexes an empty slice, causing an index-out-of-bounds panic that terminates the entire server process.
Risk Assessment
A remote client can trigger a panic and stop the whole server, causing denial of service. In insecure or ordinary TLS deployments the attack requires no authentication.
Recommendation
Update gRPC-Go to version 1.82.2 or 1.83.2 (or later), which contain the fix for this issue.
Other vulnerabilities in gRPC-Go
See all- GHSA-hrxh-6v49-42gfHigh
Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.
- CVE-2026-33186Critical
A vulnerability in gRPC-Go before version 1.79.3 allows authorization bypass due to improper validation of the HTTP/2 `:path` pseudo-header. The server accepted requests with a missing leading slash (e.g., `Service/Method` instead of `/Service/Method`), causing deny rules based on canonical paths to be ineffective. An attacker can exploit this to bypass security policies if a fallback allow rule exists.
- CVE-2026-84304High
gRPC-Go prior to 1.83.1 stores each fragmented HTTP/2 DATA frame as a separate recvMsg, so millions of one-byte frames can consume disproportionate heap memory. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or OOM termination. Receive-buffer compaction is enabled by default and can be controlled with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. Fixed in 1.83.1.
- CVE-2026-84303Medium
gRPC-Go prior to version 1.83.1 contains a vulnerability in the xDS RBAC HTTP filter where header matcher names are not lowercased even though incoming metadata keys are lowercase. A DENY policy using mixed-case names such as X-Role or User-Agent does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Original NVD description (English source)
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS