CVE-2026-84445 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
A remote attacker can crash gRPC-Go xDS servers by sending RPCs missing authority headers, causing an unrecovered panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84445?
CVE-2026-84445 is a high-severity denial of service vulnerability in grpc-go, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
Which versions are affected by CVE-2026-84445?
9 open source packages ship an affected version, including google.golang.org/grpc.
| Package | Affected | Fixed in |
|---|---|---|
google.golang.org/grpc Go | All versions | 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e |
google.golang.org/grpc Go | All versions | 1.82.2 |
google.golang.org/grpc Go | All versions | 1.82.2 |
google.golang.org/grpc Go | From 1.83.0 | 1.83.2 |
google.golang.org/grpc Go | From 1.83.0 | 1.83.2 |
google.golang.org/grpc Go | From 1.84.0-dev | 1.84.0-dev.0.20260825144003-d5a41119e0e3 |
3 more packages
google.golang.org/grpc Go | From 1.84.0-dev | 1.84.0-dev.0.20260825144003-d5a41119e0e3 |
google.golang.org/grpc Go | From 1.85.0-dev | 1.85.0-dev.0.20260825072537-93e31b48545e |
google.golang.org/grpc Go | From 1.85.0-dev | 1.85.0-dev.0.20260825072537-93e31b48545e |
Linux distribution packages (31)
opentelemetry-collector AlmaLinux:10 | All versions | 0.158.0-1.el10_2 |
opentelemetry-collector AlmaLinux:9 | All versions | 0.158.0-1.el9_8 |
opentelemetry-collector Red Hat:enterprise_linux:10.2 | All versions | 0:0.158.0-1.el10_2 |
rhc Red Hat:enterprise_linux:8::appstream | All versions | 1:0.2.5-12.el8_10 |
rhc-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:0.2.5-12.el8_10 |
rhc-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:0.2.5-12.el8_10 |
opentelemetry-collector Red Hat:enterprise_linux:9::appstream | All versions | 0:0.158.0-1.el9_8 |
rhc Red Hat:enterprise_linux:9::appstream | All versions | 1:0.2.7-13.el9_8 |
rhc-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:0.2.7-13.el9_8 |
rhc-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:0.2.7-13.el9_8 |
rhc-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 1:0.2.7-13.el9_8 |
rhc-debugsource Red Hat:enterprise_linux:9::crb | All versions | 1:0.2.7-13.el9_8 |
rhc-devel Red Hat:enterprise_linux:9::crb | All versions | 1:0.2.7-13.el9_8 |
opentelemetry-collector Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.158.0-1.el10_0 |
rhc Red Hat:rhel_e4s:9.2::appstream | All versions | 1:0.2.2-1.el9_2.6 |
rhc-debuginfo Red Hat:rhel_e4s:9.2::appstream | All versions | 1:0.2.2-1.el9_2.6 |
rhc-debugsource Red Hat:rhel_e4s:9.2::appstream | All versions | 1:0.2.2-1.el9_2.6 |
opentelemetry-collector Red Hat:rhel_e4s:9.4::appstream | All versions | 0:0.158.0-1.el9_4 |
rhc Red Hat:rhel_e4s:9.4::appstream | All versions | 1:0.2.4-9.el9_4.2 |
rhc-debuginfo Red Hat:rhel_e4s:9.4::appstream | All versions | 1:0.2.4-9.el9_4.2 |
rhc-debugsource Red Hat:rhel_e4s:9.4::appstream | All versions | 1:0.2.4-9.el9_4.2 |
opentelemetry-collector Red Hat:rhel_eus:9.6::appstream | All versions | 0:0.158.0-1.el9_6 |
rhc Red Hat:rhel_eus:9.6::appstream | All versions | 1:0.2.7-1.el9_6.7 |
rhc-debuginfo Red Hat:rhel_eus:9.6::appstream | All versions | 1:0.2.7-1.el9_6.7 |
rhc-debugsource Red Hat:rhel_eus:9.6::appstream | All versions | 1:0.2.7-1.el9_6.7 |
rhc-debuginfo Red Hat:rhel_eus:9.6::crb | All versions | 1:0.2.7-1.el9_6.7 |
rhc-debugsource Red Hat:rhel_eus:9.6::crb | All versions | 1:0.2.7-1.el9_6.7 |
rhc-devel Red Hat:rhel_eus:9.6::crb | All versions | 1:0.2.7-1.el9_6.7 |
opentelemetry-collector Rocky Linux:10 | All versions | 0:0.158.0-1.el10_2 |
opentelemetry-collector Rocky Linux:9 | All versions | 0:0.158.0-1.el9_8 |
inspektor-gadget openSUSE:Tumbleweed | All versions | 0.57.0-1.1 |
How do I fix CVE-2026-84445?
Upgrade google.golang.org/grpc to a fixed version for your release line: 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3 or 1.85.0-dev.0.20260825072537-93e31b48545e.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-84445 being exploited?
There is no known exploitation of CVE-2026-84445 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:76743, ALSA-2026:76744, AZL-100971, AZL-100974, AZL-100977, AZL-100980 and 1180 more.