Skip to content
Heist/ feed
HighFix available

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Type: advisorySource: OSV1 source record

A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS). Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate. This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic. - Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash. - mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic. ### Impact An attacker can cause a complete outage of the gRPC server by s

Announced Source revision 1
Original source ↗

GHSA-2v4p-qf9q-27wj

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-2v4p-qf9q-27wj

google.golang.org/grpc

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.82.2

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

google.golang.org/grpc

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1.83.2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

google.golang.org/grpc

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1.84.0-dev.0.20260825144003-d5a41119e0e3

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

google.golang.org/grpc

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1.85.0-dev.0.20260825072537-93e31b48545e

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.82.2"
          }
        ]
      }
    ],
    "package": {
      "name": "google.golang.org/grpc",
      "purl": "pkg:golang/google.golang.org/grpc",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2v4p-qf9q-27wj/GHSA-2v4p-qf9q-27wj.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.83.0"
          },
          {
            "fixed": "1.83.2"
          }
        ]
      }
    ],
    "package": {
      "name": "google.golang.org/grpc",
      "purl": "pkg:golang/google.golang.org/grpc",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2v4p-qf9q-27wj/GHSA-2v4p-qf9q-27wj.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.84.0-dev"
          },
          {
            "fixed": "1.84.0-dev.0.20260825144003-d5a41119e0e3"
          }
        ]
      }
    ],
    "package": {
      "name": "google.golang.org/grpc",
      "purl": "pkg:golang/google.golang.org/grpc",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2v4p-qf9q-27wj/GHSA-2v4p-qf9q-27wj.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.85.0-dev"
          },
          {
            "fixed": "1.85.0-dev.0.20260825072537-93e31b48545e"
          }
        ]
      }
    ],
    "package": {
      "name": "google.golang.org/grpc",
      "purl": "pkg:golang/google.golang.org/grpc",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2v4p-qf9q-27wj/GHSA-2v4p-qf9q-27wj.json"
    }
  }
]
Related CVEs
CVE-2026-84445

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Event
#17553 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement