gRPC-Go xDS servers: Denial of Service (DoS)

Published September 8, 2026 CVE-2026-84445

A remote request can crash gRPC-Go servers using xDS traffic routing. The entire server process can stop, causing a complete service outage.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 1.82.2, 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545eFix recorded 2 days ago
Affected versions
before 1.82.2; 1.83.0 or newer, but before 1.83.2; 1.84.0-dev or newer, but before 1.85.0-dev.0.20260825072537-93e31b48545e
Weakness
CWE-129Improper Validation of Array Index
Affects
google.golang.org/grpc

How it works

  • The attacker sends a request without the expected server address information.
  • The affected server accepts the request and passes it to its routing logic.
  • That logic assumes an address exists and tries to read a missing entry.
  • The resulting error is not contained, so the entire server process exits.

What to do

Ask the application maintainer whether the server uses gRPC-Go's xDS server mode. Compare its resolved google.golang.org/grpc version with the affected ranges above. A vulnerable version confirms exposure, not that an attack occurred.

Upgrade the relevant branch to 1.82.2, 1.83.2, or 1.85.0-dev.0.20260825072537-93e31b48545e. Then confirm the deployed build contains that updated dependency.

Technical details

Affected software: google.golang.org/grpc

CVE-2026-84445 affects servers created with xds. NewGRPCServer. A request missing both:authority and Host reaches the xDS routing interceptor, which reads the first item from an empty authority list. The unhandled panic terminates the server process. The fix rejects these requests earlier in the HTTP/2 transport layer.

Strict transport authentication limits exploitation to clients possessing valid transport credentials.

References

View Original Source