CVE-2026-84445: 
Nomad vulnerability analysis and mitigation

CVE-2026-84445 is a Denial of Service (DoS) vulnerability in gRPC-Go servers configured with xds.NewGRPCServer() that allows an attacker to crash the entire server process by sending a crafted HTTP/2 request missing both :authority and Host headers. The vulnerability was discovered by researcher winklemad and reported to Google's OSS VRP on August 23, 2026, before being publicly disclosed via GitHub on August 25, 2026, with the advisory published to the GitHub Advisory Database on September 8, 2026. Affected versions of google.golang.org/grpc (Go) include all releases before 1.82.2, versions 1.83.0 through 1.83.1, and 1.84.0-dev through 1.85.0-dev.0.20260825072537-93e31b48545e. The vulnerability is rated High severity by the GitHub Advisory Database (GitHub Advisory).

The root cause is an improper validation of an array index (CWE-129) combined with an uncaught exception/panic (CWE-248) in the xDS routing interceptor (internal/xds/server/routing.go). The HTTP/2 server transport in gRPC-Go previously accepted requests lacking both :authority and Host headers; when such a request reached the xDS interceptor, the code called md.Get(":authority") and immediately accessed authority[0] without checking if the slice was empty, triggering a Go runtime index out of range panic. Because the per-RPC goroutine has no recover() call, this unhandled panic propagates and terminates the entire server process. Exploitation requires that the attacker first complete the transport-layer handshake (TLS/mTLS/ALTS) and HTTP/2 connection establishment before the crafted request reaches the vulnerable interceptor pipeline (GitHub Advisory, GitHub Issue #9354).

Successful exploitation causes a complete outage of the affected gRPC server — the entire server process terminates immediately upon receiving a single malicious request. On servers permitting insecure (plaintext) or standard TLS connections (where client certificates are not required), any unauthenticated remote attacker can trigger the crash. On servers enforcing mTLS or ALTS, an attacker must possess valid transport credentials, limiting the attack surface to authenticated principals. There is no evidence of confidentiality or integrity impact; the consequence is purely an availability loss (GitHub Advisory).

No public proof-of-concept exploit code or exploit kits have been identified for this vulnerability, and there is no evidence of in-the-wild exploitation as of the advisory publication date. The Feedly threat intelligence data lists no recorded exploitation events and no PoC entries. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. The attack is straightforward in concept — sending a single malformed HTTP/2 request — making it low-complexity for any attacker who can reach the server's gRPC port (GitHub Advisory, Feedly).

1. Reconnaissance: Identify gRPC-Go servers using xds.NewGRPCServer() that are network-accessible. Servers permitting plaintext or standard TLS connections are directly targetable without credentials.
2. Establish transport connection: Complete the HTTP/2 connection handshake with the target server (including TLS negotiation if required). For mTLS-protected servers, valid client certificates must be obtained first.
3. Craft malicious HTTP/2 request: Construct an HTTP/2 HEADERS frame that omits both the :authority pseudo-header and the Host header. A minimal frame would include only :method: POST, :path: /SomeService/SomeMethod, and content-type: application/grpc.
4. Send the request: Transmit the crafted HEADERS frame to the server over the established HTTP/2 connection.
5. Trigger server crash: The xDS routing interceptor attempts to access authority[0] on an empty slice, causing a Go runtime panic that terminates the entire server process, resulting in a complete DoS (GitHub Issue #9354, GitHub Advisory).

• Logs: Go runtime panic output in server logs containing panic: runtime error: index out of range [0] with length 0 with a stack trace referencing RouteAndProcess in internal/xds/server/routing.go and xdsUnaryInterceptor.
• Logs: Sudden, unexpected server process termination with no graceful shutdown log entries.
• Network: Inbound HTTP/2 HEADERS frames to the gRPC port that lack both :authority and Host headers; these can be identified via packet capture by inspecting HTTP/2 pseudo-headers on HEADERS frames.
• Process: Abrupt exit of the gRPC server process (e.g., process restart events, systemd service failure notifications, container restarts) without a corresponding application-level error or shutdown signal (GitHub Issue #9354).

Upgrade google.golang.org/grpc to one of the patched versions: 1.82.2, 1.83.2, or 1.85.0-dev.0.20260825072537-93e31b48545e (master). The fix updates internal/transport/http2_server.go to reject requests missing both :authority and Host headers early in the transport layer with HTTP 400 and gRPC status Internal, and adds a defensive bounds check in internal/xds/server/routing.go before accessing the authority slice. No configuration-based workaround is available for servers using xds.NewGRPCServer(); upgrading is the only reliable remediation. Enforcing mTLS at the network edge reduces the attack surface but does not eliminate the vulnerability for authenticated clients (GitHub Advisory, Patch Commit).