CVE-2026-84445High· 8.7▾ TwilightgRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host heade…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 8.7
0.7%
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
google.golang.org/grpc < 1.82.2google.golang.org/grpc >= 1.83.0, < 1.83.2google.golang.org/grpc >= 1.84.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545ePatched in:
google.golang.org/grpc 1.82.2google.golang.org/grpc 1.83.2google.golang.org/grpc 1.85.0-dev.0.20260825072537-93e31b48545eSource: https://osv.dev/vulnerability/GHSA-2v4p-qf9q-27wj
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32285High· 7.5The Delete function fails to properly validate offsets when processing malformed JSON input
CVE-2026-0799High· 8.7In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value
CVE-2026-32286High· 7.5The DataRow.Decode function fails to properly validate field lengths
CVE-2026-84303MediumgRPC-Go is the Go language implementation of gRPC
CVE-2026-84304HighgRPC-Go is the Go language implementation of gRPC
CVE-2023-1380High· 7.1A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel