PkgSeer

Vulnerability GO-2026-6443

Unknown

4 hours ago

Server panic via missing authority or Host headers in google.golang.org/grpc

v1.0.0 - v1.82.1

Summary

Server panic via missing authority or Host headers in google.golang.org/grpc

Details

In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc

v1.0.0 - v1.83.0 GO-2026-6348

Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc

v1.0.0 - v1.83.0 GO-2026-6441

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

v1.0.0 - v1.82.1 and v1.83.0 - v1.83.1 and v1.84.0-dev - v1.85.0-dev GHSA-2v4p-qf9q-27wj

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

v1.0.0 - v1.83.0 GHSA-qc2q-p7wx-3px3

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

v1.0.0 - v1.83.0 GHSA-vp52-pcj8-j9qc

View all vulnerabilities for these packages

Impacted packages

google.golang.org/grpc

Timeline

Published

4 hours ago

Last Modified

4 hours ago