gRPC-Go Vulnerability in Server Implementation by Google
CVE-2026-84445
What is CVE-2026-84445?
In gRPC-Go, prior to versions 1.82.2 and 1.83.2, a security issue exists in the server implementation when using xds.NewGRPCServer(). The server can accept RPCs that lack both the :authority and Host header, resulting in potential index-out-of-bounds panics during processing. This vulnerability can lead to server crashes, impacting service availability. In scenarios with insecure deployments or standard TLS, unauthenticated requests can exploit this vulnerability. Although secure deployments with strict mTLS or ALTS require valid credentials, once the malformed request is received, it can trigger the panic and terminate the server process. This issue has been addressed in the latest versions of gRPC-Go.
Affected Version(s)
grpc-go < 1.82.2 < 1.82.2
grpc-go >= 1.83.0, < 1.83.2 < 1.83.0, 1.83.2