Source: golang-google-grpc Version: 1.81.1-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for golang-google-grpc. CVE-2026-84445[0]: | gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 | and 1.83.2, servers created with xds.NewGRPCServer() allow | internal/transport/http2_server.go to accept an RPC containing | neither the :authority header nor the Host header, while | RouteAndProcess in internal/xds/server/routing.go assumes that an | authority value exists and indexes the empty slice. A remote client | that can complete transport connection establishment can trigger an | index-out-of-bounds panic that is not recovered by the per-RPC | goroutine and terminates the entire server process. In insecure or | ordinary TLS deployments the request can be unauthenticated, while | strict mTLS or ALTS deployments require valid transport credentials | before the malformed RPC can reach the interceptor. This issue is | fixed in versions 1.82.2 and 1.83.2. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-84445 https://www.cve.org/CVERecord?id=CVE-2026-84445 [1] https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj [2] https://github.com/grpc/grpc-go/issues/9354 [3] https://github.com/grpc/grpc-go/pull/9367 [4] https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
