Junglewise Threat Intelligence

CVE-2026-84445: gRPC-Go xDS server denial of service via missing headers

CVE-2026-84445 · Severity: high · Published 2026-09-08

Executive brief

gRPC-Go is a popular RPC framework used to build distributed applications and microservices. When configured with xDS routing (a service mesh feature), servers crash if they receive HTTP/2 requests missing both the `:authority` and `Host` headers, causing a complete service outage. An attacker who can establish a network connection to the server can trigger this crash remotely.

Technical details

This vulnerability is an uncaught exception (CWE-248) combined with improper array index validation (CWE-129). The root cause lies in the HTTP/2 transport layer which previously accepted requests missing both the `:authority` and `Host` headers. When such a request reaches the xDS routing interceptor, it attempts to look up the request's `:authority` header in an empty slice of authorities, causing an index out of bounds panic. Since the per-RPC goroutine lacks panic recovery, the entire server process terminates. The attack requires successful completion of the transport credentials handshake (TLS/mTLS/ALTS) and HTTP/2 connection establishment before the malicious request can reach the interceptor. On insecure or standard TLS connections, unauthenticated remote attackers can trigger the crash; on mTLS/ALTS, valid transport credentials are required. Patches are available in versions 1.82.2, 1.83.2, and 1.85.0-dev.0.20260825072537-93e31b48545e, which enforce early rejection of requests missing both headers.

Affected products

  • Google gRPC-Go < 1.82.2; 1.83.0 - 1.83.1; 1.84.0-dev - < 1.85.0-dev.0.20260825072537-93e31b48545e

Timeline

  • 2026-08-25: disclosed
  • 2026-08-25: patched: Patches released for versions 1.82.2, 1.83.2, and 1.85.0-dev branch
  • 2026-09-08: advisory

References