CVE-2026-84445
Received Received - Intake

Index-Out-of-Bounds Panic in gRPC-Go

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-84445
EUVD
EUVD-2026-77627

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
grpc grpc-go to 1.82.2 (inc)
grpc grpc-go to 1.83.2 (inc)
grpc grpc-go From 1.84.0 (inc)
grpc grpc-go to 1.83.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in gRPC-Go allows a remote client to crash the entire server process by sending an RPC request missing both the :authority header and the Host header. The server fails to validate these mandatory HTTP/2 headers, leading to an unhandled panic when processing the request. This occurs because the routing logic assumes the :authority header exists and attempts to access an empty slice, causing an index-out-of-bounds error.

Detection Guidance

To detect this vulnerability, monitor your gRPC-Go servers for crashes or panics when processing requests. Check server logs for HTTP 400 errors or gRPC Internal status codes (13) indicating missing :authority or Host headers. Use tools like Wireshark or tcpdump to capture and inspect HTTP/2 traffic for malformed requests lacking these headers.

Impact Analysis

This vulnerability can cause a denial of service by crashing your gRPC server, disrupting all services. In insecure or standard TLS setups, unauthenticated attackers can exploit it remotely. In strict mTLS or ALTS deployments, attackers must first establish a valid connection before triggering the crash.

Compliance Impact

This vulnerability primarily causes server crashes due to unhandled panics, leading to denial-of-service conditions. It does not directly impact data confidentiality or integrity but may disrupt service availability, which could indirectly affect compliance with standards like GDPR (requiring data processing availability) or HIPAA (requiring timely access to health data). The lack of header validation does not inherently violate these regulations but may contribute to operational failures.

Mitigation Strategies

Upgrade gRPC-Go to version 1.82.2 or 1.83.2 or later. If upgrading is not immediately possible, implement network-level controls to block malformed HTTP/2 requests missing :authority or Host headers. Review server configurations to ensure proper header validation is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart