gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- grpc grpc-go
fixed in 1.82.2; From 1.83.0 · fixed in 1.83.2
- google.golang.org/grpcGo
fixed in 1.82.2
- google.golang.org/grpcGo
From 1.83.0 · fixed in 1.83.2
- google.golang.org/grpcGo
From 1.84.0-dev · fixed in 1.84.0-dev.0.20260825144003-d5a41119e0e3
- google.golang.org/grpcGo
From 1.85.0-dev · fixed in 1.85.0-dev.0.20260825072537-93e31b48545e
- google.golang.org/grpcGo
fixed in 1.82.2; From 1.83.0 · fixed in 1.83.2; From 1.84.0-dev · fixed in 1.84.0-dev.0.20260825144003-d5a41119e0e3; From 1.85.0-dev · fixed in 1.85.0-dev.0.20260825072537-93e31b48545e