CVE-2026-84445: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-84445 is a Denial of Service vulnerability in gRPC-Go (the Go language implementation of gRPC) affecting servers created with xds.NewGRPCServer(). A remote attacker can send a crafted HTTP/2 request omitting both the :authority and Host headers, triggering an index-out-of-bounds panic in the xDS routing interceptor that terminates the entire server process. Affected versions are all releases prior to 1.82.2 and versions 1.83.0–1.83.1; the issue is fixed in 1.82.2 and 1.83.2. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly). The vulnerability was reported by researcher winklemad (also identified as matiasinsaurralde) and disclosed publicly on August 25, 2026, with patches released the same day.

The root cause is an improper validation of an array index (CWE-129) combined with an uncaught exception (CWE-248) in two components: internal/transport/http2_server.go and internal/xds/server/routing.go. The HTTP/2 transport layer accepts incoming RPCs that carry neither the :authority pseudo-header nor the Host header — a condition the code comments acknowledge as invalid but does not reject. When such a request reaches the xDS routing interceptor (RouteAndProcess), the function calls md.Get(":authority") which returns an empty slice, then immediately indexes authority[0], causing a panic: runtime error: index out of range [0] with length 0. Because the per-RPC goroutine has no recover() wrapping this code path, the panic propagates and kills the entire server process (GitHub Issue #9354, GitHub Advisory). The fix, implemented in PR #9365, updates the HTTP/2 transport layer to reject such requests early with an HTTP 400 response and adds a defensive guard in the xDS routing interceptor (GitHub PR #9365).

Successful exploitation results in a complete, immediate denial of service — the entire gRPC server process terminates with a fatal panic, affecting all concurrent connections and in-flight RPCs. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. In insecure or standard TLS deployments, any unauthenticated remote attacker who can reach the server's network port can trigger the crash with a single malformed request, making the attack highly automatable and repeatable. Deployments using strict mTLS or ALTS are partially protected, as an attacker would first need valid transport credentials before the malformed RPC can reach the vulnerable interceptor (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.685%, indicating a low but non-negligible probability of exploitation in the near term. Despite the absence of a public PoC, the attack is trivially reproducible by any attacker who understands HTTP/2 framing, as it only requires omitting standard headers from a connection request. The NVD SSVC assessment classifies the vulnerability as automatable with no known active exploitation (Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible gRPC servers built with xds.NewGRPCServer() running gRPC-Go versions prior to 1.82.2 or between 1.83.0 and 1.83.1. Tools like Shodan or Censys can identify exposed gRPC endpoints.
2. Establish transport connection: Complete the HTTP/2 connection handshake with the target server. For insecure or standard TLS deployments, no credentials are required. For mTLS/ALTS deployments, valid client certificates must be obtained first.
3. Craft malformed HTTP/2 request: Construct an HTTP/2 HEADERS frame for a new stream that omits both the :authority pseudo-header and the Host header. This can be done using low-level HTTP/2 libraries (e.g., golang.org/x/net/http2, Python's h2, or curl --http2) that allow manual control over header fields.
4. Send the request: Transmit the crafted HEADERS frame to any valid gRPC method endpoint on the server. The transport layer will accept and dispatch the request.
5. Trigger server crash: The xDS routing interceptor attempts authority[0] on an empty slice, causing an unrecovered panic that terminates the entire server process, resulting in a complete denial of service (GitHub Issue #9354, GitHub Advisory).

• Logs: Go runtime panic output in server logs containing panic: runtime error: index out of range [0] with length 0 with a stack trace referencing internal/xds/server/routing.go (specifically the RouteAndProcess function) and internal/transport/http2_server.go.
• Logs: Abrupt server process termination with no graceful shutdown log entries, potentially followed by process restart events in systemd/container orchestration logs.
• Network: Incoming HTTP/2 connections from unexpected source IPs that complete the TLS handshake but send HEADERS frames lacking both :authority and Host fields; these may appear as very short-lived connections in access logs.
• Process: Unexpected termination and restart of the gRPC server process (e.g., container restarts in Kubernetes, service restarts in systemd) without corresponding application-level error handling.

The primary remediation is to upgrade gRPC-Go to a patched version: 1.82.2 (for the 1.82.x branch) or 1.83.2 (for the 1.83.x branch); version 1.84.0 and later are also unaffected (GitHub Advisory, GitHub PR #9365). Downstream products incorporating gRPC-Go should also be updated: Microsoft Azure Linux packages and IBM Quantum Safe Remediator have issued their own advisories (Microsoft MSRC, IBM Advisory). As a partial workaround for deployments that cannot immediately upgrade, enforcing strict mTLS or ALTS with validated client certificates at the transport layer significantly reduces the attack surface by requiring an authenticated client to trigger the vulnerability. SUSE and Red Hat have also released updated packages for affected ecosystem components such as Helm, azcopy, and others (SUSE Advisory).

The vulnerability was originally reported to Google's OSS Vulnerability Rewards Program (issue 551288012), which classified it as a product vulnerability not eligible for a reward under the project's tier and directed the reporter to open a public GitHub issue (GitHub Issue #9354). The gRPC-Go maintainers responded rapidly, merging the fix and releasing patched versions on the same day the advisory was published (August 25, 2026). The fix was cherry-picked to multiple stable branches (v1.82.x, v1.83.x, v1.84.x) within hours. The vulnerability has been picked up by multiple Linux distribution security teams (SUSE, openSUSE, Red Hat) and scanner vendors (Tenable Nessus, Qualys), indicating broad ecosystem awareness and active patching activity across dependent projects.