CVE-2026-84445: CWE-129: Improper Validation of Array Index in grpc grpc-go
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
AI Analysis
Technical Summary
In grpc-go versions before 1.82.2 and between 1.83.0 and before 1.83.2, servers created with xds.NewGRPCServer() accept RPCs lacking both the :authority and Host headers. The routing code assumes an authority value exists and indexes an empty slice, triggering an index-out-of-bounds panic. This panic is not recovered by the per-RPC goroutine, causing the entire server process to terminate. In insecure or ordinary TLS setups, the malformed request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC reaches the interceptor. The flaw is addressed in versions 1.82.2 and 1.83.2.
Potential Impact
A remote unauthenticated attacker who can establish a transport connection can cause a denial of service by crashing the grpc-go server process due to an unhandled index-out-of-bounds panic. This can disrupt availability of services relying on the affected grpc-go server. The severity is high due to the potential for complete server termination without recovery.
Mitigation Recommendations
Upgrade grpc-go to version 1.82.2 or later, or 1.83.2 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory.
CVE-2026-84445: CWE-129: Improper Validation of Array Index in grpc grpc-go
Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
CVSS v4.0
Score 8.7high
Affected software
grpc
grpc-go
pkg:golang/github.com/grpc/grpc-goRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In grpc-go versions before 1.82.2 and between 1.83.0 and before 1.83.2, servers created with xds.NewGRPCServer() accept RPCs lacking both the :authority and Host headers. The routing code assumes an authority value exists and indexes an empty slice, triggering an index-out-of-bounds panic. This panic is not recovered by the per-RPC goroutine, causing the entire server process to terminate. In insecure or ordinary TLS setups, the malformed request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC reaches the interceptor. The flaw is addressed in versions 1.82.2 and 1.83.2.
Potential Impact
A remote unauthenticated attacker who can establish a transport connection can cause a denial of service by crashing the grpc-go server process due to an unhandled index-out-of-bounds panic. This can disrupt availability of services relying on the affected grpc-go server. The severity is high due to the potential for complete server termination without recovery.
Mitigation Recommendations
Upgrade grpc-go to version 1.82.2 or later, or 1.83.2 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T20:05:09.422Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa81e7f55bf5e2cf54cc3a1
Added to database: 09/14/2026, 16:19:11 UTC
Last enriched: 09/14/2026, 16:31:27 UTC
Last updated: 09/14/2026, 17:00:02 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.