HIGH GitHub
CVE-2026-84445
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS).
Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this hap
Affected Products
- go/google.golang.org/grpc < 1.82.2
- go/google.golang.org/grpc >= 1.83.0, < 1.83.2
- go/google.golang.org/grpc >= 1.84.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e
References
- https://github.com/advisories/GHSA-2v4p-qf9q-27wj
- https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
- https://github.com/grpc/grpc-go/issues/9354
- https://github.com/grpc/grpc-go/pull/9365
This high severity vulnerability was published on 2026-09-08 via GitHub. Affected: go/google.golang.org/grpc < 1.82.2, go/google.golang.org/grpc >= 1.83.0, < 1.83.2, go/google.golang.org/grpc >= 1.84.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e.
vulnfeed aggregates 12842 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.