---
id: CVE-2026-84445
title: gRPC-Go is the Go language implementation of gRPC
summary: >-
  gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2,
  servers created with xds.NewGRPCServer() allow
  internal/transport/http2_server.go to accept an RPC containing neither the
  :authority header nor the Host heade…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-129
  - CWE-248
  - CWE-125
vendor: grpc
product: grpc-go
affected:
  - grpc-go < 1.82.2
  - 'grpc-go >= 1.83.0, < 1.83.2'
patched:
  - google.golang.org/grpc 1.82.2
  - google.golang.org/grpc 1.83.2
  - google.golang.org/grpc 1.85.0-dev.0.20260825072537-93e31b48545e
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T17:17:51.743'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84445'
references:
  - url: >-
      https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7
    label: security-advisories@github.com
  - url: >-
      https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4
    label: security-advisories@github.com
  - url: >-
      https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/issues/9354'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/pull/9365'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/pull/9366'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/pull/9367'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/releases/tag/v1.82.2'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/releases/tag/v1.83.2'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj'
    label: security-advisories@github.com
  - url: 'https://github.com/grpc/grpc-go'
  - url: 'https://github.com/advisories/GHSA-2v4p-qf9q-27wj'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84445.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84445'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2533175'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84445'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84445'
tags:
  - nvd
  - cve.org
  - osv
  - go
  - ghsa
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T16:36:00.554548Z'
cvssSource: cna
aliases:
  - GHSA-2v4p-qf9q-27wj
  - GO-2026-6443
ecosystem: go
ingestedAt: '2026-09-08T22:12:30.968Z'
epss: 0.00685
epssPercentile: 0.50778
scores:
  cna: 8.7
  vendor: 7.5
---

## Overview

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84445)

Affected packages:

- `google.golang.org/grpc < 1.82.2`
- `google.golang.org/grpc >= 1.83.0, < 1.83.2`
- `google.golang.org/grpc >= 1.84.0-dev, < 1.85.0-dev.0.20260825072537-93e31b48545e`

Patched in:

- `google.golang.org/grpc 1.82.2`
- `google.golang.org/grpc 1.83.2`
- `google.golang.org/grpc 1.85.0-dev.0.20260825072537-93e31b48545e`

Source: https://osv.dev/vulnerability/GHSA-2v4p-qf9q-27wj

## Vendor advisories

- **Red Hat VEX** · Important · affected: AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Cost Management On Premise, … · no fix planned: OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Developer Hub, Red Hat Hardened Images, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84445.json)