CVE-2026-84445

gRPC-Go servers created with xds.NewGRPCServer() accept an HTTP/2 RPC that contains neither the :authority nor the Host header, but the xDS routing layer (RouteAndProcess) assumes an authority value exists and indexes an empty slice, causing an index-out-of-bounds panic. Because the panic is not recovered by the per-RPC goroutine, a single malformed RPC terminates the entire server process, so any remote client that can complete transport setup can repeatedly crash (or crash-loop) the service. In deployments using plaintext or ordinary TLS the request requires no authentication; strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC reaches the vulnerable path. The flaw affects gRPC-Go releases prior to 1.82.2 and 1.83.2 and is rated high severity (CVSS 4.0: 8.7) due to full availability impact with no privileges or user interaction required. There is no known public proof-of-concept and no indication of in-the-wild exploitation, and the issue is fixed in versions 1.82.2 and 1.83.2.

What to do: Upgrade gRPC-Go to version 1.82.2 or 1.83.2 (or later) as soon as possible. If immediate patching is not possible, require strict mTLS or ALTS transport credentials on the gRPC port so unauthenticated clients cannot reach the vulnerable routing path, and note that authenticated clients could still trigger the crash. Audit Go services for use of xds.NewGRPCServer() and monitor gRPC server processes for unexpected exits or crash loops that could indicate exploitation attempts.