Vulnerability-Lookup

RHSA-2026:79326

Vulnerability from csaf_redhat - Published: 2026-10-08 15:15 - Updated: 2026-10-27 04:28

Summary

Red Hat Security Advisory: Helm CLI for Red Hat OpenShift 4.3.0 container image release

Severity

Important

Notes

Topic: An updated Helm CLI for Red Hat OpenShift container image is now available.

Details: Helm is the package manager for Kubernetes, used to define, install and upgrade applications as reusable charts. This container image provides the Helm CLI for Red Hat OpenShift, built on the ubi9-minimal base image, with the Helm binary available at /usr/local/bin/helm.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-84445

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64	—	Vendor Fix fix
Unresolved product id: Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x	—	Vendor Fix fix
Unresolved product id: Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le	—	Vendor Fix fix
Unresolved product id: Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64	—	Vendor Fix fix

Threats

Impact Important

References

20 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:79326	self
https://access.redhat.com/security/cve/CVE-2026-84445	external
https://access.redhat.com/security/updates/classi…	external
https://catalog.redhat.com/software/containers/he…	external
https://helm.sh/docs/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-84445	self
https://bugzilla.redhat.com/show_bug.cgi?id=2533175	external
https://www.cve.org/CVERecord?id=CVE-2026-84445	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84445	external
https://github.com/grpc/grpc-go/commit/3822494d8e…	external
https://github.com/grpc/grpc-go/commit/8668b69c16…	external
https://github.com/grpc/grpc-go/commit/93e31b4854…	external
https://github.com/grpc/grpc-go/issues/9354	external
https://github.com/grpc/grpc-go/pull/9365	external
https://github.com/grpc/grpc-go/pull/9366	external
https://github.com/grpc/grpc-go/pull/9367	external
https://github.com/grpc/grpc-go/releases/tag/v1.82.2	external
https://github.com/grpc/grpc-go/releases/tag/v1.83.2	external
https://github.com/grpc/grpc-go/security/advisori…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated Helm CLI for Red Hat OpenShift container image is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Helm is the package manager for Kubernetes, used to define, install and upgrade\napplications as reusable charts. This container image provides the Helm CLI for\nRed Hat OpenShift, built on the ubi9-minimal base image, with the Helm binary\navailable at /usr/local/bin/helm.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:79326",
        "url": "https://access.redhat.com/errata/RHSA-2026:79326"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84445",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/helm-cli/helm-cli-rhel9",
        "url": "https://catalog.redhat.com/software/containers/helm-cli/helm-cli-rhel9"
      },
      {
        "category": "external",
        "summary": "https://helm.sh/docs/",
        "url": "https://helm.sh/docs/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79326.json"
      }
    ],
    "title": "Red Hat Security Advisory: Helm CLI for Red Hat OpenShift 4.3.0 container image release",
    "tracking": {
      "current_release_date": "2026-10-27T04:28:12+00:00",
      "generator": {
        "date": "2026-10-27T04:28:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:79326",
      "initial_release_date": "2026-10-08T15:15:05+00:00",
      "revision_history": [
        {
          "date": "2026-10-08T15:15:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-08T15:15:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-27T04:28:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Helm CLI 4.3",
                "product": {
                  "name": "Helm CLI 4.3",
                  "product_id": "Helm CLI 4.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:helm_cli:4.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Helm CLI"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64",
                "product": {
                  "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64",
                  "product_id": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/helm-cli-rhel9@sha256%3Ae96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea?arch=amd64\u0026repository_url=registry.redhat.io/helm-cli/helm-cli-rhel9\u0026tag=1789719277"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64",
                "product": {
                  "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64",
                  "product_id": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/helm-cli-rhel9@sha256%3A6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86?arch=arm64\u0026repository_url=registry.redhat.io/helm-cli/helm-cli-rhel9\u0026tag=1789719277"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le",
                "product": {
                  "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le",
                  "product_id": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/helm-cli-rhel9@sha256%3Adbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa?arch=ppc64le\u0026repository_url=registry.redhat.io/helm-cli/helm-cli-rhel9\u0026tag=1789719277"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x",
                "product": {
                  "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x",
                  "product_id": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/helm-cli-rhel9@sha256%3A755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd?arch=s390x\u0026repository_url=registry.redhat.io/helm-cli/helm-cli-rhel9\u0026tag=1789719277"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64 as a component of Helm CLI 4.3",
          "product_id": "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64"
        },
        "product_reference": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64",
        "relates_to_product_reference": "Helm CLI 4.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x as a component of Helm CLI 4.3",
          "product_id": "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x"
        },
        "product_reference": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x",
        "relates_to_product_reference": "Helm CLI 4.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le as a component of Helm CLI 4.3",
          "product_id": "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le"
        },
        "product_reference": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le",
        "relates_to_product_reference": "Helm CLI 4.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64 as a component of Helm CLI 4.3",
          "product_id": "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64"
        },
        "product_reference": "registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64",
        "relates_to_product_reference": "Helm CLI 4.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84445",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-09-14T16:22:17.356407+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2533175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64",
          "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x",
          "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le",
          "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "RHBZ#2533175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84445",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/issues/9354",
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9365",
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9366",
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/pull/9367",
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        }
      ],
      "release_date": "2026-09-14T16:11:41.401000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-08T15:15:05+00:00",
          "details": "The container image provided by this update can be downloaded from the Red Hat\ncontainer registry at registry.redhat.io using the \"podman pull\" command:\n\npodman pull registry.redhat.io/helm-cli/helm-cli-rhel9:4.3.0",
          "product_ids": [
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64",
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x",
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le",
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:79326"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:6283ec75e97316605c6dd8400413674ec504447752156ae74d2737d37f76ef86_arm64",
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:755c4afc353dd874fc36431baf4137741f0d59b7b44bbbc4bc7f5f4c5637cdbd_s390x",
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:dbe85e9563dc51e81c18d0b9a1ca5e8d8c5ff0f509ab8fb06a8eead495e1f3fa_ppc64le",
            "Helm CLI 4.3:registry.redhat.io/helm-cli/helm-cli-rhel9@sha256:e96947b8bdefdd349a5a80aad236d8a03cc10ec557a53e9951281fa481c3cfea_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests"
    }
  ]
}

CVE-2026-84445 (GCVE-0-2026-84445)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:11 – Updated: 2026-09-14 16:36

Title

gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

Summary

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:36 UTC

CWE

CWE-129 - Improper Validation of Array Index
CWE-248 - Uncaught Exception

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7797 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/grpc/grpc-go/security/advisori…	x_refsource_CONFIRM
https://github.com/grpc/grpc-go/issues/9354	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9365	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9366	x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9367	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/3822494d8e…	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/8668b69c16…	x_refsource_MISC
https://github.com/grpc/grpc-go/commit/93e31b4854…	x_refsource_MISC
https://github.com/grpc/grpc-go/releases/tag/v1.82.2	x_refsource_MISC
https://github.com/grpc/grpc-go/releases/tag/v1.83.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grpc	grpc-go	Affected: < 1.82.2 Affected: >= 1.83.0, < 1.83.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84445",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:36:00.554548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:36:14.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-go",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.82.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.83.0, \u003c 1.83.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-129",
              "description": "CWE-129: Improper Validation of Array Index",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:11:41.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
        },
        {
          "name": "https://github.com/grpc/grpc-go/issues/9354",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/issues/9354"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9365",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9365"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9366",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9366"
        },
        {
          "name": "https://github.com/grpc/grpc-go/pull/9367",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/pull/9367"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
        },
        {
          "name": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
        },
        {
          "name": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
        },
        {
          "name": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2v4p-qf9q-27wj",
        "discovery": "UNKNOWN"
      },
      "title": "gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84445",
    "datePublished": "2026-09-14T16:11:41.401Z",
    "dateReserved": "2026-09-01T20:05:09.422Z",
    "dateUpdated": "2026-09-14T16:36:14.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted