gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Date Sep 8, 2026

Type Vendor advisory

Signal High-risk advisory

Vendor / Product Go · google.golang.org/grpc

CVE CVE-2026-84445

High-risk advisory CVE-2026-84445

Summary

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Why it matters

GitHub has published a reviewed security advisory for google.golang.org/grpc. Prioritize it with other application dependency updates.

Operator check

Check whether google.golang.org/grpc is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available.

Sources

GitHub Advisory GHSA-2v4p-qf9q-27wj NVD — CVE-2026-84445 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed