CVE-2026-84445: gRPC-Go xDS servers Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2v4p-qf9q-27wj",
  "modified" : "2026-09-25T17:42:20Z",
  "published" : "2026-09-08T21:21:43Z",
  "aliases" : [ "CVE-2026-84445" ],
  "summary" : "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers",
  "details" : "A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS).\n\nServers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.\n\nThis panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.\n- Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.\n- mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.\n\n### Impact\nAn attacker can cause a complete outage of the gRPC server by sending a request missing both `:authority` and `Host` headers, provided they can successfully establish a transport connection.\n\n### Patches\nThe issue has been addressed in `master` (and backported to `1.84.0`, `1.83.2` and `1.82.2`). The fix updates the HTTP/2 transport layer to reject requests missing both `:authority` and `Host` headers early, maintaining consistency with and other gRPC language implementations.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "google.golang.org/grpc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.82.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "google.golang.org/grpc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.83.0"
      }, {
        "fixed" : "1.83.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "google.golang.org/grpc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.84.0-dev"
      }, {
        "fixed" : "1.84.0-dev.0.20260825144003-d5a41119e0e3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "google.golang.org/grpc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.85.0-dev"
      }, {
        "fixed" : "1.85.0-dev.0.20260825072537-93e31b48545e"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/issues/9354"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/pull/9365"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/pull/9366"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/pull/9367"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/grpc/grpc-go"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-129", "CWE-248" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-08T21:21:43Z",
    "nvd_published_at" : "2026-09-14T17:17:51Z"
  }
}