Answer in brief
CVE-2026-84445 records a High severity vulnerability in gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers. The current sources do not mark it as known exploited. The current feed maps google.golang.org/grpc (go), google.golang.org/grpc (go), google.golang.org/grpc (go), google.golang.org/grpc (go) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps google.golang.org/grpc (go), google.golang.org/grpc (go), google.golang.org/grpc (go), google.golang.org/grpc (go) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| google.golang.org/grpcgo | <1.82.2 | 1.82.2 |
| google.golang.org/grpcgo | >=1.83.0,<1.83.2 | 1.83.2 |
| google.golang.org/grpcgo | >=1.84.0-dev,<1.85.0-dev.0.20260825072537-93e31b48545e | 1.85.0-dev.0.20260825072537-93e31b48545e |
| google.golang.org/grpcgo | >=0 <1.82.2 | 1.82.2 |
| google.golang.org/grpcgo | >=1.83.0 <1.83.2 | 1.83.2 |
| google.golang.org/grpcgo | >=1.84.0-dev <1.85.0-dev.0.20260825072537-93e31b48545e | 1.85.0-dev.0.20260825072537-93e31b48545e |
Published upstream
Sep 8, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Sep 8, 2026
A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS). Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate. This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic. - Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash. - mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic. ### Impact An attacker can cause a complete outage of the gRPC server by sending a request missing both `:authority` and `Host` headers, provided they can successfully establish a transport connection. ### Patches The issue has been addressed in `master` (and backported to `1.83.2` and `1.82.2`). The fix updates the HTTP/2 transport layer to reject requests missing both `:authority` and `Host` headers early, maintaining consistency with and other gRPC language implementations.
Quoted source text, attributed separately from HOL analysis.