highCVE-2026-84445Sep 8, 2026

CVE-2026-84445: gRPC-Go xDS Server Denial of Service via Missing :authority Header

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

gRPC-Go servers using the xDS API crash and terminate when an attacker sends an HTTP/2 request that omits both the :authority pseudo-header and the Host header, taking down the entire service.

Packagegoogle.golang.org/grpc
Ecosystemgo
Affected< 1.82.2
Fixed in1.82.2
CVE-2026-84445: gRPC-Go xDS Server Denial of Service via Missing :authority Header

The problem

Servers created with xds.NewGRPCServer() install an xDS routing interceptor on every incoming RPC. That interceptor reads the :authority header to select a virtual host for routing.

Before the fix, the HTTP/2 transport accepted requests with neither :authority nor Host present. When the interceptor then tried to read authorities[0] from an empty slice, Go panicked with an index out of bounds. Because per-RPC goroutines do not recover from panics, the whole server process died.

Any attacker who can complete a transport handshake (TLS or plaintext) can trigger this with a single request.

Proof of concept

A working proof-of-concept for CVE-2026-84445 in google.golang.org/grpc, with the exact payload below.

http
PRI * HTTP/2.0

SM


# HTTP/2 connection preface, then a HEADERS frame with NO :authority and NO Host.
# Mandatory pseudo-headers only: :method, :scheme, :path.
# Sent as raw HTTP/2 frames (e.g. via h2c or after TLS handshake).

HEADERS frame {
  :method  = POST
  :scheme  = http
  :path    = /package.Service/Method
  content-type = application/grpc
  # :authority  <- deliberately absent
  # Host        <- deliberately absent
}

The root cause is CWE-129 (Improper Validation of Array Index). The xDS interceptor built a slice of authority values from the incoming metadata and immediately indexed element 0, with no length check. When both :authority and Host are missing the slice is empty, and authorities[0] panics at runtime.

The patch (PR #9365, commit 93e31b4 by eshitachandwani) moves the validation to the HTTP/2 transport layer. The transport now rejects any HEADERS frame where both :authority and Host are absent with an HTTP 400 and gRPC status Internal, so the request never reaches the interceptor.

This matches the behavior of other gRPC language implementations.

The fix

Upgrade google.golang.org/grpc to v1.82.2 or later (also fixed in v1.83.2 and master). No configuration workaround exists. If you cannot upgrade immediately, place a network-level control in front of xDS servers to block connections from untrusted clients, reducing the attack surface to authenticated callers only.

Reported by eshitachandwani (Easwar Swaminathan, Google gRPC team).

References: [1][2][3][4][5][6]

Related research