{"id":"GO-2026-6443","revision":"81e88ac243bb465791d081deab63a4c7","records":[{"revision":"81e88ac243bb465791d081deab63a4c7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6443","aliases":["CVE-2026-84445","GHSA-2v4p-qf9q-27wj"],"title":"Server panic via missing authority or Host headers in google.golang.org/grpc","description":"In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.","state":0,"publishedAt":"2026-09-15T18:39:25+00:00","modifiedAt":"2026-10-07T17:45:12.2233687+00:00","affected":[{"ecosystem":"Go","name":"google.golang.org/grpc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.82.2"},{"kind":"introduced","version":"1.83.0"},{"kind":"fixed","version":"1.83.2"},{"kind":"introduced","version":"1.84.0-dev"},{"kind":"fixed","version":"1.84.0-dev.0.20260825144003-d5a41119e0e3"},{"kind":"introduced","version":"1.85.0-dev"},{"kind":"fixed","version":"1.85.0-dev.0.20260825072537-93e31b48545e"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6443","license":"OSV · upstream source license applies","key":"osv:GO-2026-6443","identifiers":["GO-2026-6443","CVE-2026-84445","GHSA-2v4p-qf9q-27wj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}