Skip to content
Fencer Vulns
high 8.7

CVE-2026-84445 json

gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

published 2026-09-08 2 mo ago modified 2026-10-07 32 d ago also GHSA-2v4p-qf9q-27wj , GO-2026-6443 , EUVD-2026-77627

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

Patch / fix

  • go google.golang.org/grpc 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e
  • opentelemetry-collector RHEL 9 0.158.0-1.el9_8
  • opentelemetry-collector RHEL 10.2 0.158.0-1.el10_2
  • rhc RHEL 8 1:0.2.5-12.el8_10
  • rhc RHEL 9 1:0.2.7-13.el9_8
  • opentelemetry-collector RHEL 9.4 E4S 0.158.0-1.el9_4
  • opentelemetry-collector RHEL 9.6 EUS 0.158.0-1.el9_6
  • opentelemetry-collector enterprise linux eus 10.0 0.158.0-1.el10_0
  • rhc RHEL 9.2 E4S 1:0.2.2-1.el9_2.6

red hat advisories RHSA-2026:82346RHSA-2026:82342RHSA-2026:82344RHSA-2026:79012RHSA-2026:79010RHSA-2026:79011

  • amazon-ecs-init SLES for SAP applications 16.0, SLES 16.0 1.108.0-160000.1.1
  • terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.29.2
  • terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.26.2
  • terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.34.2
  • terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.32.2
  • terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.30.2
  • terraform-provider-google SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.43.0-150200.6.23.2
  • terraform-provider-random SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.26.2

suse advisories SUSE-SU-2026:24265-1SUSE-SU-2026:4628-1SUSE-SU-2026:4444-1SUSE-SU-2026:4389-1SUSE-SU-2026:4388-1SUSE-SU-2026:4308-1

  • rqlite openSUSE Leap 16.0 10.6.6-bp160.1.1
  • warewulf4 openSUSE Leap 16.0 4.7.1-bp160.2.1
  • warewulf4 openSUSE Tumbleweed 4.7.1-2.1
  • containerized-data-importer1.65 openSUSE Tumbleweed 1.65.0-4.1
  • kubevirt1.8 openSUSE Tumbleweed 1.8.4-7.1
  • amazon-ecs-init openSUSE Leap 16.0 1.108.0-160000.1.1
  • gh openSUSE Leap 16.0 2.102.0-bp160.1.1
  • rqlite openSUSE Tumbleweed 10.6.1-1.1

opensuse advisories openSUSE-SU-2026:22224-1openSUSE-SU-2026:22221-1openSUSE-SU-2026:12375-1openSUSE-SU-2026:12235-1openSUSE-SU-2026:12241-1openSUSE-SU-2026:22145-1

  • opentelemetry-collector AlmaLinux 10 0.158.0-1.el10_2
  • opentelemetry-collector AlmaLinux 9 0.158.0-1.el9_8

almalinux advisories ALSA-2026:76743ALSA-2026:76744

  • osbuild-composer Rocky Linux 9 165.1-5.el9_8.1.rocky.0.1
  • opentelemetry-collector Rocky Linux 9 0.158.0-1.el9_8
  • opentelemetry-collector Rocky Linux 10 0.158.0-1.el10_2

rocky linux advisories RLSA-2026:95272RLSA-2026:76744RLSA-2026:76743

  • azcopy Azure Linux 3.0 10.25.1-9
  • azurelinux-image-tools Azure Linux 3.0 1.6.0-3
  • cert-manager Azure Linux 3.0 1.12.15-14
  • cloud-provider-kubevirt Azure Linux 3.0 0.5.1-9
  • containerd2 Azure Linux 3.0 2.3.7-1
  • containerized-data-importer Azure Linux 3.0 1.62.0-8
  • coredns Azure Linux 3.0 1.11.4-21
  • docker-compose Azure Linux 3.0 2.27.0-15

azure linux advisories AZL-100989AZL-100992AZL-100995AZL-101001AZL-101007AZL-101010

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84445 updated cvss 7.5

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-rhel9-operator, ansible-automation-platform/automation-orchestrator-temporal-rhel9, ansible-automation-platform/automation-orchestrator-operator-bundle Red Hat AWS Load Balancer Operator albo/aws-load-balancer-controller-rhel8 Red Hat Compliance Operator compliance/openshift-compliance-operator-bundle Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat DPU kit for NVIDIA dpu-kit-for-nvidia/dpf-hcp-provisioner-rhel10-operator Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/external-secrets-operator-rhel9
    +10 more products
    Red Hat ExternalDNS Operator edo/external-dns-rhel8, edo/external-dns-rhel9 Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel9-operator Red Hat File Integrity Operator compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle Red Hat Job Set 1 job-set/jobset-rhel9, job-set/jobset-rhel9-operator Red Hat Job Set Tech Preview job-set/jobset-rhel9, job-set/jobset-rhel9-operator, job-set/jobset-operator-bundle Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-rhel9-operator, kmm/kernel-module-management-hub-rhel9-operator, kmm/kernel-module-management-webhook-server-rhel9 Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator Red Hat Leader Worker Set leader-worker-set/lws-rhel9, leader-worker-set/lws-rhel9-operator, leader-worker-set/lws-operator-bundle Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel9-operator, workload-availability/machine-deletion-remediation-operator-bundle
    affected: no fix available
  • Red Hat MCP Server for Red Hat OpenShift openshift-mcp-beta/openshift-mcp-server-rhel9, openshift-mcp-tech-preview/openshift-mcp-server-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-rhel9-operator, mta/mta-analyzer-addon-rhel9, mta/mta-solution-server-rhel9, mta/mta-go-external-provider-rhel9, mta/mta-java-external-provider-rhel9, +2 more Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-rhel8-operator Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhel9-operator Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/hypershift-rhel9-operator, multicluster-engine/image-based-install-rhel9, multicluster-engine/kube-rbac-proxy-mce-rhel9, multicluster-engine/azure-service-operator-rhel9, +3 more Red Hat Network Observability Operator network-observability/network-observability-rhel9-operator, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-must-gather-rhel8
    +3 more products
    Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel9-operator Red Hat OpenShift API for Data Protection oadp/oadp-velero-plugin-for-csi-rhel9, oadp/oadp-hypershift-velero-plugin-rhel9 Red Hat OpenShift Developer Tools and Services helm 3.21.4-86.el9
    affected: no fix available
  • Red Hat OpenShift Lightspeed openshift-lightspeed/otelcol-lightspeed-rhel9, openshift-lightspeed/lightspeed-rhel9-operator, openshift-lightspeed/openshift-mcp-server-rhel9, openshift-lightspeed/lightspeed-agentic-sandbox-rhel9, openshift-lightspeed/lightspeed-agentic-rhel9-operator Red Hat OpenShift Pipelines openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines/pipelines-cache-rhel9, openshift-pipelines/pipelines-events-rhel8, openshift-pipelines/pipelines-events-rhel9, openshift-pipelines-client 1.22.0-11814.el9, openshift-pipelines/pipelines-cli-tkn-rhel8, +51 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator Red Hat OpenShift Serverless kn-workflow-plugin 1.38.0-3.el9, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-clients 1.17.0-4.el9, openshift-serverless-1/logic-rhel9-operator, openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-serving-queue-rhel9, +28 more
    affected: no fix available
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator
    affected: no fix planned “Will not fix”
  • Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/kepler-rhel9, openshift-power-monitoring/power-monitoring-rhel9-operator, openshift-power-monitoring/power-monitoring-operator-bundle
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel9, rhacm2/acm-prometheus-rhel9, rhacm2/acm-siteconfig-rhel9, rhacm2/lighthouse-agent-rhel9, rhacm2/mtv-integrations-rhel9, rhacm2/kube-state-metrics-rhel9, +9 more
    affected: no fix available, no fix planned “Will not fix”
show 4 more
  • Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-27/hub-rhel9, ansible-automation-platform-24/ee-supported-rhel8, ansible-automation-platform-24/ee-supported-rhel9, ansible-automation-platform-24/hub-rhel8-operator, ansible-automation-platform-25/ee-supported-rhel8, +21 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Build of Kueue kueue/kueue-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0
    affected: no fix available
  • Red Hat Ceph Storage 5 rhceph/snmp-notifier-rhel8, rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/snmp-notifier-rhel9, rhceph/rhceph-promtail-rhel9, rhceph/rhceph-6-dashboard-rhel9
    affected: no fix available “Fix deferred”

31 more affected, 62 more fixed, 86 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
55 d ago

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go google.golang.org/grpc
<1.82.2
>=1.83.0, <1.83.2
>=1.84.0-dev, <1.84.0-dev.0.20260825144003-d5a41119e0e3
>=1.85.0-dev, <1.85.0-dev.0.20260825072537-93e31b48545e
1.82.2
1.83.2
1.84.0-dev.0.20260825144003-d5a41119e0e3
1.85.0-dev.0.20260825072537-93e31b48545e

Affected products

  • grpc grpc-go

Classification

Weakness
  • CWE-129 Improper Validation of Array Index
  • CWE-248 Uncaught Exception

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.