gRPC-Go is the Go language implementation of gRPC.

CVE-2026-84445 is an index-out-of-bounds panic in gRPC-Go's xDS server routing interceptor. When a server is created via xds.NewGRPCServer(), every inbound RPC passes through a routing interceptor that looks up the :authority pseudo-header to select a virtual host. If a crafted HTTP/2 request arrives with *neither* the :authority header nor the Host header, the interceptor tries to read the first element of an empty slice — Go panics, and because the per-RPC goroutine has no recover(), the entire server process terminates. All versions of google.golang.org/grpc before 1.82.2, and the 1.83.0–1.83.1 range, are affected. The fix landed in 1.82.2 and 1.83.2. Crucially, only servers instantiated with xds.NewGRPCServer() are vulnerable; the standard grpc.NewServer() path — which represents the vast majority of grpc-go deployments — is completely unaffected.

Third-party CVSS 4.0 assessments peg this at 8.7 (HIGH), and the GitHub Security Advisory from grpc/grpc-go labels it High. That rating accurately reflects the raw mechanics: network-reachable, no authentication required (in non-mTLS configs), zero user interaction, full availability impact from a single packet. But it overweights the theoretical population. The xDS server API is a proxyless service-mesh feature used by teams running Istio proxyless gRPC, Google Traffic Director, or custom xDS control planes — a small fraction of the enormous grpc-go install base. The majority of those xDS deployments live inside Kubernetes clusters behind load balancers with mTLS enabled, which blocks unauthenticated exploitation entirely. The impact ceiling is DoS — no data exfiltration, no code execution, no lateral movement. Kubernetes auto-restarts crashed pods, limiting sustained outage. A MEDIUM assessment better reflects the real-world exploitability and blast radius.

1. Upgrade grpc-go to v1.82.2 or v1.83.2 — The definitive fix. Both patch versions reject requests missing :authority and Host at the HTTP/2 transport layer before they reach the xDS routing interceptor. Per the noisgate remediation SLA for MEDIUM, deploy within 365 days. If you actively use xds.NewGRPCServer() in production, prioritize this within weeks — the upgrade is a drop-in dependency bump with no API changes.
2. Enable mTLS or ALTS on all xDS-enabled gRPC servers — mTLS requires valid client certificates before the transport handshake completes, blocking unauthenticated exploitation entirely. Istio and Traffic Director support mTLS as a mesh-wide policy (PeerAuthentication in STRICT mode). This should be your default posture regardless of this CVE. No mitigation SLA applies for MEDIUM severity — go straight to the remediation window.
3. Deploy an L7 proxy or Envoy sidecar in front of xDS servers — A compliant HTTP/2 intermediary (Envoy, nginx, HAProxy) can validate or inject the :authority header before traffic reaches the gRPC server. Envoy's http2_protocol_options and HTTP connection manager will typically reject or normalize requests missing :authority, acting as a pre-filter. If you're using Istio with sidecars alongside proxyless gRPC, ensure the sidecar is the ingress point.
4. Configure Kubernetes liveness probes and PodDisruptionBudgets — Ensure liveness probes detect crashed gRPC servers and trigger rapid restarts. Set PodDisruptionBudget with minAvailable to maintain service capacity during crash-restart cycles. This limits sustained DoS impact from repeated exploitation but does NOT prevent individual crashes.
5. Monitor for crash-loop signatures — Alert on kube_pod_container_status_restarts_total spikes and grep container logs for runtime error: index out of range [0] with length 0 in routing.go. This provides post-exploitation detection and helps distinguish CVE-2026-84445 crashes from other Go panics.

Run this script on any machine with access to the Go project source tree (developer workstation, CI runner, or build server). It requires no special privileges — only read access to go.mod and *.go source files. Invoke as: bash check_cve_2026_84445.sh /path/to/your/go/project

#!/usr/bin/env bash
# CVE-2026-84445 Verification Script
# Checks if a Go project uses a vulnerable version of google.golang.org/grpc
# AND whether xds.NewGRPCServer() is in use (the only affected code path).
#
# Usage:  bash check_cve_2026_84445.sh /path/to/go/project
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit:   1 = vulnerable, 0 = patched, 2 = unknown

set -euo pipefail

PROJECT_DIR="${1:-.}"
GOMOD="$PROJECT_DIR/go.mod"

if [[ ! -f "$GOMOD" ]]; then
  echo "UNKNOWN - No go.mod found at $GOMOD"
  exit 2
fi

# Extract grpc-go version from go.mod (direct or indirect)
GRPC_LINE=$(grep -E 'google\.golang\.org/grpc\s+v' "$GOMOD" | head -1 || true)
if [[ -z "$GRPC_LINE" ]]; then
  echo "UNKNOWN - google.golang.org/grpc not found in go.mod"
  exit 2
fi

GRPC_VERSION=$(echo "$GRPC_LINE" | awk '{print $2}' | sed 's/^v//')
echo "[*] Found google.golang.org/grpc version: v$GRPC_VERSION"

# Check for xds.NewGRPCServer usage in Go source files
XDS_USED="no"
if grep -rq 'xds\.NewGRPCServer\|"google\.golang\.org/grpc/xds"' "$PROJECT_DIR" --include='*.go' 2>/dev/null; then
  XDS_USED="yes"
  echo "[!] xds.NewGRPCServer() or xds import detected in source code"
else
  echo "[i] No xds.NewGRPCServer() usage found (standard grpc.NewServer is NOT affected)"
fi

# Portable version comparison: returns 0 if $1 >= $2
version_gte() {
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

# Determine vulnerability status
# Vulnerable ranges: < 1.82.2  OR  (>= 1.83.0 AND < 1.83.2)
VULN="no"
if version_gte "$GRPC_VERSION" "1.83.0" && ! version_gte "$GRPC_VERSION" "1.83.2"; then
  VULN="yes"
  RANGE="[1.83.0, 1.83.2)"
elif ! version_gte "$GRPC_VERSION" "1.82.2"; then
  VULN="yes"
  RANGE="(< 1.82.2)"
fi

if [[ "$VULN" == "yes" ]]; then
  if [[ "$XDS_USED" == "yes" ]]; then
    echo "VULNERABLE - grpc-go v$GRPC_VERSION in range $RANGE with xds.NewGRPCServer() usage"
    echo "  -> Upgrade to v1.82.2+ or v1.83.2+ immediately."
    exit 1
  else
    echo "VULNERABLE - grpc-go v$GRPC_VERSION in range $RANGE (dependency is vulnerable)"
    echo "  -> xds.NewGRPCServer() not detected in source; effective risk is LOW unless xDS is used at runtime."
    echo "  -> Upgrade to v1.82.2+ or v1.83.2+ as part of routine maintenance."
    exit 1
  fi
else
  echo "PATCHED - grpc-go v$GRPC_VERSION is not in the vulnerable range"
  exit 0
fi

1. GitHub Security Advisory (GHSA-2v4p-qf9q-27wj)
2. Go Vulnerability Database — GO-2026-6443
3. GitLab Advisory Database
4. KrakenD Security Advisory (confirmed not affected)
5. OffSeq Threat Radar — CVE-2026-84445
6. Strix.ai CVE Detail
7. OpenCVE — CVE-2026-84445
8. Grafana Alerting dependency update (downstream impact)