CVE-2026-84445 grpc CVE debrief

Who should care

Defenders of gRPC-Go servers created with xds.NewGRPCServer() should assess exposure and verify if their servers are running vulnerable versions. This includes operators, platform administrators, and security teams responsible for gRPC-Go server management. They should review server configurations, monitor for potential attacks, and plan for upgrades to fixed versions to prevent server process termination from unauthenticated requests.

Why it matters

Defenders of gRPC-Go servers should assess exposure, verify versions, and upgrade to fixed versions to prevent server process termination from unauthenticated requests.

• Remote clients can trigger server process termination.
• Unauthenticated requests can reach the interceptor in insecure or ordinary TLS deployments.
• Valid transport credentials are required in strict mTLS or ALTS deployments.
• Verification of exposure and remediation priority is necessary.

Technical summary

The gRPC-Go implementation has a vulnerability where servers created with xds.NewGRPCServer() accept RPCs without :authority or Host headers, leading to an index-out-of-bounds panic in internal/transport/http2_server.go and internal/xds/server/routing.go. This issue is fixed in versions 1.82.2 and 1.83.2. The vulnerability can cause server process termination and is exploitable in insecure or ordinary TLS deployments without authentication. Defenders should prioritize verifying exposure and upgrading to fixed versions.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to fixed versions 1.82.2 or 1.83.2.

Recommended defensive actions

• Verify if gRPC-Go servers created with xds.NewGRPCServer() are exposed and running vulnerable versions.
• Upgrade to gRPC-Go version 1.82.2 or 1.83.2.
• Monitor server logs for index-out-of-bounds panic errors.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while source references include commits and pull requests fixing the issue in gRPC-Go versions 1.82.2 and 1.83.2. The vulnerability allows remote clients to trigger a panic, potentially leading to server process termination. Evidence of exposure includes server logs showing index-out-of-bounds panic errors. Defenders should verify server versions and monitor logs for signs of exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.