CVE-2026-84445: gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

Published Sep 8, 2026
·
Updated

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic. - Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash. - mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches The issue has been addressed in master (and backported to 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Other sources

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

— NVD

gRPC-Go: Denial of Service (DoS) via crash due to missing :authority and Host headers in the xDS servers

— Microsoft

Affected Software

67 affected componentsFixes available
go/google.golang.org/grpc>=1.84.0-dev<1.85.0-dev.0.20260825072537-93e31b48545e
1.85.0-dev.0.20260825072537-93e31b48545e
go/google.golang.org/grpc>=1.83.0<1.83.2
1.83.2
go/google.golang.org/grpc<1.82.2
1.82.2
Microsoft azl3 gh 2.98.0-1<2.101.0-1
2.101.0-1
Microsoft azl3 cloud-provider-kubevirt 0.5.1-7<0.5.1-9
0.5.1-9
Microsoft azl3 telegraf 1.31.0-31<1.31.0-33
1.31.0-33
Microsoft azl3 kube-vip-cloud-provider 0.0.10-8<0.0.10-10
0.0.10-10
Microsoft azl3 cert-manager 1.12.15-12<1.12.15-14
1.12.15-14
Microsoft azl3 coredns 1.11.4-20<1.11.4-21
1.11.4-21
Microsoft azl3 kata-containers-cc 3.15.0.aks0-20<3.15.0.aks0-21
3.15.0.aks0-21
Microsoft azl3 vitess 19.0.4-13<19.0.4-14
19.0.4-14
Microsoft azl3 azcopy 10.25.1-8<10.25.1-9
10.25.1-9
Microsoft azl3 containerized-data-importer 1.62.0-7<1.62.0-8
1.62.0-8
Microsoft azl3 influxdb 2.7.5-20<2.7.5-21
2.7.5-21
Microsoft azl3 skopeo 1.14.4-12<1.14.4-13
1.14.4-13
Microsoft azl3 kata-containers 3.32.0.kata0-5<3.32.0.kata0-6
3.32.0.kata0-6
Microsoft azl3 sriov-network-device-plugin 3.7.0-7<3.7.0-8
3.7.0-8
Microsoft azl3 azurelinux-image-tools 1.6.0-2<1.6.0-3
1.6.0-3
Microsoft azl3 etcd 3.5.33-1<3.5.34-1
3.5.34-1
All of the following
azurelinux/kubevirt<1.8.4-3
1.8.4-3
Microsoft Azure Linux=3.0
All of the following
azurelinux/keda<2.14.1-21
2.14.1-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/kubernetes<1.30.10-31
1.30.10-31
Microsoft Azure Linux=3.0
All of the following
azurelinux/prometheus-adapter<0.12.0-11
0.12.0-11
Microsoft Azure Linux=3.0
All of the following
azurelinux/flannel<0.24.2-33
0.24.2-33
Microsoft Azure Linux=3.0
All of the following
azurelinux/docker-compose<2.27.0-15
2.27.0-15
Microsoft Azure Linux=3.0
All of the following
azurelinux/vitess<19.0.4-14
19.0.4-14
Microsoft Azure Linux=3.0
All of the following
azurelinux/kata-containers-cc<3.15.0.aks0-21
3.15.0.aks0-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/kata-containers<3.32.0.kata0-6
3.32.0.kata0-6
Microsoft Azure Linux=3.0
All of the following
azurelinux/sriov-network-device-plugin<3.7.0-8
3.7.0-8
Microsoft Azure Linux=3.0
All of the following
azurelinux/influxdb<2.7.5-21
2.7.5-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/moby-engine<25.0.3-21
25.0.3-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/skopeo<1.14.4-13
1.14.4-13
Microsoft Azure Linux=3.0
All of the following
azurelinux/coredns<1.11.4-21
1.11.4-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/gh<2.101.0-1
2.101.0-1
Microsoft Azure Linux=3.0
All of the following
azurelinux/etcd<3.5.34-1
3.5.34-1
Microsoft Azure Linux=3.0
All of the following
azurelinux/azurelinux-image-tools<1.6.0-3
1.6.0-3
Microsoft Azure Linux=3.0
All of the following
azurelinux/containerized-data-importer<1.62.0-8
1.62.0-8
Microsoft Azure Linux=3.0
All of the following
azurelinux/azcopy<10.25.1-9
10.25.1-9
Microsoft Azure Linux=3.0
All of the following
azurelinux/cert-manager<1.12.15-14
1.12.15-14
Microsoft Azure Linux=3.0
All of the following
azurelinux/kube-vip-cloud-provider<0.0.10-10
0.0.10-10
Microsoft Azure Linux=3.0
All of the following
azurelinux/cloud-provider-kubevirt<0.5.1-9
0.5.1-9
Microsoft Azure Linux=3.0
All of the following
azurelinux/telegraf<1.31.0-33
1.31.0-33
Microsoft Azure Linux=3.0
All of the following
azurelinux/containerd2<2.3.7-1
2.3.7-1
Microsoft Azure Linux=3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/google.golang.org/grpc to a version that resolves this vulnerability.

    Fixed in 1.85.0-dev.0.20260825072537-93e31b48545e
  2. Upgrade

    Upgrade go/google.golang.org/grpc to a version that resolves this vulnerability.

    Fixed in 1.83.2
  3. Upgrade

    Upgrade go/google.golang.org/grpc to a version that resolves this vulnerability.

    Fixed in 1.82.2
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.101.0-1
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.5.1-9
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.31.0-33
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.0.10-10
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.12.15-14
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.11.4-21
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.15.0.aks0-21
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 19.0.4-14
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.25.1-9
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.62.0-8
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.7.5-21
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.14.4-13
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.32.0.kata0-6
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.7.0-8
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.6.0-3
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 3.5.34-1
  20. Upgrade

    Upgrade azurelinux/kubevirt to a version that resolves this vulnerability.

    Fixed in 1.8.4-3
  21. Upgrade

    Upgrade azurelinux/keda to a version that resolves this vulnerability.

    Fixed in 2.14.1-21
  22. Upgrade

    Upgrade azurelinux/kubernetes to a version that resolves this vulnerability.

    Fixed in 1.30.10-31
  23. Upgrade

    Upgrade azurelinux/prometheus-adapter to a version that resolves this vulnerability.

    Fixed in 0.12.0-11
  24. Upgrade

    Upgrade azurelinux/flannel to a version that resolves this vulnerability.

    Fixed in 0.24.2-33
  25. Upgrade

    Upgrade azurelinux/docker-compose to a version that resolves this vulnerability.

    Fixed in 2.27.0-15
  26. Upgrade

    Upgrade azurelinux/vitess to a version that resolves this vulnerability.

    Fixed in 19.0.4-14
  27. Upgrade

    Upgrade azurelinux/kata-containers-cc to a version that resolves this vulnerability.

    Fixed in 3.15.0.aks0-21
  28. Upgrade

    Upgrade azurelinux/kata-containers to a version that resolves this vulnerability.

    Fixed in 3.32.0.kata0-6
  29. Upgrade

    Upgrade azurelinux/sriov-network-device-plugin to a version that resolves this vulnerability.

    Fixed in 3.7.0-8
  30. Upgrade

    Upgrade azurelinux/influxdb to a version that resolves this vulnerability.

    Fixed in 2.7.5-21
  31. Upgrade

    Upgrade azurelinux/moby-engine to a version that resolves this vulnerability.

    Fixed in 25.0.3-21
  32. Upgrade

    Upgrade azurelinux/skopeo to a version that resolves this vulnerability.

    Fixed in 1.14.4-13
  33. Upgrade

    Upgrade azurelinux/coredns to a version that resolves this vulnerability.

    Fixed in 1.11.4-21
  34. Upgrade

    Upgrade azurelinux/gh to a version that resolves this vulnerability.

    Fixed in 2.101.0-1
  35. Upgrade

    Upgrade azurelinux/etcd to a version that resolves this vulnerability.

    Fixed in 3.5.34-1
  36. Upgrade

    Upgrade azurelinux/azurelinux-image-tools to a version that resolves this vulnerability.

    Fixed in 1.6.0-3
  37. Upgrade

    Upgrade azurelinux/containerized-data-importer to a version that resolves this vulnerability.

    Fixed in 1.62.0-8
  38. Upgrade

    Upgrade azurelinux/azcopy to a version that resolves this vulnerability.

    Fixed in 10.25.1-9
  39. Upgrade

    Upgrade azurelinux/cert-manager to a version that resolves this vulnerability.

    Fixed in 1.12.15-14
  40. Upgrade

    Upgrade azurelinux/kube-vip-cloud-provider to a version that resolves this vulnerability.

    Fixed in 0.0.10-10
  41. Upgrade

    Upgrade azurelinux/cloud-provider-kubevirt to a version that resolves this vulnerability.

    Fixed in 0.5.1-9
  42. Upgrade

    Upgrade azurelinux/telegraf to a version that resolves this vulnerability.

    Fixed in 1.31.0-33
  43. Upgrade

    Upgrade azurelinux/containerd2 to a version that resolves this vulnerability.

    Fixed in 2.3.7-1
  44. Upgrade

    Upgrade gRPC-Go (xds.NewGRPCServer) to a version that resolves this vulnerability.

    Fixed in 1.82.2
  45. Upgrade

    Upgrade gRPC-Go (xds.NewGRPCServer) to a version that resolves this vulnerability.

    Fixed in 1.83.2

Event History

Sep 8, 2026
Advisory Published
via GitHub·09:21 PM
Data Sourced
via GitHub·09:21 PM
DescriptionWeaknessAffected Software
Sep 14, 2026
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
DescriptionWeakness
Data Sourced
via OSV·04:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Sep 16, 2026
Data Sourced
via Microsoft·08:05 AM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which deployments are exposed to unauthenticated remote denial-of-service attempts?

Servers created with xds.NewGRPCServer() are exposed if they permit plaintext connections or use standard TLS credentials that do not validate client certificates. In those configurations, an unauthenticated remote attacker can complete the connection setup and send the malformed request.

2

Does enabling TLS by itself prevent exploitation?

No. Standard TLS prevents neither the required HTTP/2 connection establishment nor the malformed request from reaching the xDS routing interceptor when client certificates are not checked. The request must only complete the configured transport-credentials handshake before it can trigger the panic.

3

What request condition triggers the failure?

The request must omit both the HTTP/2 :authority header and the Host header. This leaves the interceptor with no authority values and causes an out-of-bounds access while selecting an xDS virtual host.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203