GO-2026-6443
Server panic via missing authority or Host headers in google.golang.org/grpc
At a glance
- Published
- Updated
- CVE
- CVE-2026-84445
- Aliases
- GHSA-2v4p-qf9q-27wj
Description
In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.
Affected packages
| Package | Versions |
|---|---|
| Go · google.golang.org/grpc | introduced 0, fixed 1.82.2, introduced 1.83.0, fixed 1.83.2, introduced 1.84.0-dev, fixed 1.84.0-dev.0.20260825144003-d5a41119e0e3, introduced 1.85.0-dev, fixed 1.85.0-dev.0.20260825072537-93e31b48545e |
References
- https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj ADVISORY
- https://github.com/grpc/grpc-go/issues/9354 REPORT
- https://github.com/grpc/grpc-go/pull/9365 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |