Executive brief
gRPC-Go is a popular RPC framework used to build distributed applications and microservices. When configured with xDS routing (a service mesh feature), servers crash if they receive HTTP/2 requests missing both the `:authority` and `Host` headers, causing a complete service outage. An attacker who can establish a network connection to the server can trigger this crash remotely.
Technical details
This vulnerability is an uncaught exception (CWE-248) combined with improper array index validation (CWE-129). The root cause lies in the HTTP/2 transport layer which previously accepted requests missing both the `:authority` and `Host` headers. When such a request reaches the xDS routing interceptor, it attempts to look up the request's `:authority` header in an empty slice of authorities, causing an index out of bounds panic. Since the per-RPC goroutine lacks panic recovery, the entire server process terminates. The attack requires successful completion of the transport credentials handshake (TLS/mTLS/ALTS) and HTTP/2 connection establishment before the malicious request can reach the interceptor. On insecure or standard TLS connections, unauthenticated remote attackers can trigger the crash; on mTLS/ALTS, valid transport credentials are required. Patches are available in versions 1.82.2, 1.83.2, and 1.85.0-dev.0.20260825072537-93e31b48545e, which enforce early rejection of requests missing both headers.
Affected products
- Google gRPC-Go < 1.82.2; 1.83.0 - 1.83.1; 1.84.0-dev - < 1.85.0-dev.0.20260825072537-93e31b48545e
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Patches released for versions 1.82.2, 1.83.2, and 1.85.0-dev branch
- 2026-09-08: advisory
References
- https://api.github.com/users/matiasinsaurralde
- https://github.com/matiasinsaurralde
- https://api.github.com/users/matiasinsaurralde/gists%7B/gist_id%7D
- https://api.github.com/users/matiasinsaurralde/repos
- https://avatars.githubusercontent.com/u/20110?v=4
- https://api.github.com/users/matiasinsaurralde/events%7B/privacy%7D