{"id":"CVE-2026-84445","title":"gRPC-Go is the Go language implementation of gRPC","summary":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host heade…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-129","CWE-248","CWE-125"],"vendor":"grpc","product":"grpc-go","affected":["grpc-go < 1.82.2","grpc-go >= 1.83.0, < 1.83.2"],"patched":["google.golang.org/grpc 1.82.2","google.golang.org/grpc 1.83.2","google.golang.org/grpc 1.85.0-dev.0.20260825072537-93e31b48545e"],"published":"2026-09-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T17:17:51.743","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","references":[{"url":"https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/issues/9354","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/pull/9365","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/pull/9366","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/pull/9367","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/releases/tag/v1.82.2","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/releases/tag/v1.83.2","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","label":"security-advisories@github.com"},{"url":"https://github.com/grpc/grpc-go"},{"url":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84445.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84445"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533175"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84445"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445"}],"tags":["nvd","cve.org","osv","go","ghsa","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-14T16:36:00.554548Z"},"cvssSource":"cna","aliases":["GHSA-2v4p-qf9q-27wj","GO-2026-6443"],"ecosystem":"go","ingestedAt":"2026-09-08T22:12:30.968Z","epss":0.00685,"epssPercentile":0.50778,"scores":{"cna":8.7,"vendor":7.5},"slug":"CVE-2026-84445","body":"## Overview\n\ngRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-84445)\n\nAffected packages:\n\n- `google.golang.org/grpc < 1.82.2`\n- `google.golang.org/grpc >= 1.83.0, < 1.83.2`\n- `google.golang.org/grpc >= 1.84.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e`\n\nPatched in:\n\n- `google.golang.org/grpc 1.82.2`\n- `google.golang.org/grpc 1.83.2`\n- `google.golang.org/grpc 1.85.0-dev.0.20260825072537-93e31b48545e`\n\nSource: https://osv.dev/vulnerability/GHSA-2v4p-qf9q-27wj\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cost Management On Premise, … · no fix planned: OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Developer Hub, Red Hat Hardened Images, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84445.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":203091,"id":"CVE-2026-84445","ts":1789409572694,"field":"cvss","old":null,"new":"8.7"}]}