Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-84445
By Mor Plada |
10 September 2026
CVE-2026-84445 – gRPC-Go xDS routing panic allows remote denial of service via missing HTTP/2 headers
In google.golang.org/grpc xDS servers created with xds.NewGRPCServer(), an RPC missing both :authority and Host can trigger an index-out-of-bounds panic in the xDS routing interceptor and terminate the process (DoS). Affects `=1.83.0,=1.84.0-dev,