Vulnerability in grpc-go

[ Description ]Official description

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR16 Oct 2026CERTFR-2026-AVI-1336

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
• CERT-FR12 Oct 2026CERTFR-2026-AVI-1293

  Multiple vulnerabilities in MongoDB Translated from French

  Multiple vulnerabilities have been discovered in MongoDB products. They allow an attacker to cause remote denial of service and a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-59649CVE-2026-59648+30 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs
• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3605

  Red Hat Enterprise Linux (rhc): Vulnerability allows denial of service Translated from German

  CVE-2026-84445

[ References ]References

• github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wjx_refsource_CONFIRM
• github.com/grpc/grpc-go/issues/9354x_refsource_MISC
• github.com/grpc/grpc-go/pull/9365x_refsource_MISC
• github.com/grpc/grpc-go/pull/9366x_refsource_MISC
• github.com/grpc/grpc-go/pull/9367x_refsource_MISC
• github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7x_refsource_MISC
• github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4x_refsource_MISC
• github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297fx_refsource_MISC
• github.com/grpc/grpc-go/releases/tag/v1.82.2x_refsource_MISC
• github.com/grpc/grpc-go/releases/tag/v1.83.2x_refsource_MISC