PT-2026-86429
CVE-2026-84445
·
تاريخ النشر
2026-09-04
·
تاريخ التحديث
2026-11-11
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
gRPC-Go versions prior to 1.82.2
gRPC-Go versions prior to 1.83.2
Description
Servers created with
xds.NewGRPCServer() are susceptible to a Denial of Service (DoS) because the HTTP/2 server transport may accept RPCs missing both the :authority header and the Host header. When such a request is processed, the RouteAndProcess function in internal/xds/server/routing.go attempts to index an empty slice of authorities, triggering an index-out-of-bounds panic. Because the per-RPC goroutine does not recover from this panic, the entire server process terminates. In insecure or standard TLS deployments, an unauthenticated remote client can trigger this crash. In strict mTLS or ALTS deployments, the attacker must possess valid transport credentials to establish a connection before the malformed RPC can reach the interceptor.Recommendations
Update gRPC-Go to version 1.82.2.
Update gRPC-Go to version 1.83.2.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾