Listen to this Post
A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS).
Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.
This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.
– Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
– mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.
DailyCVE Form:
Platform: gRPC-Go
Version: <1.82.2, <1.83.2
Vulnerability: Missing Headers Panic
Severity: High
date: 2026-09-08
Prediction: 2026-09-09
What Undercode Say:
Check your gRPC-Go version:
go list -m google.golang.org/grpc
Update to a patched version:
go get google.golang.org/[email protected]
or
go get google.golang.org/[email protected]
Exploit: (Educational Purposes!)
An attacker can trigger the panic by sending a crafted HTTP/2 request that omits both the `:authority` and `Host` headers to a vulnerable gRPC-Go server configured with xds.NewGRPCServer(). The following conceptual example demonstrates the malformed request structure:
HEADERS (flags = END_HEADERS) :method = POST :scheme = http :path = /service.Method content-type = application/grpc te = trailers
Note: The `:authority` and `Host` headers are intentionally omitted. This request, once processed by the xDS routing interceptor, will cause an index out-of-bounds panic, crashing the server process.
Protection:
Upgrade to gRPC-Go version `v1.83.2` or v1.82.2, which reject requests missing both `:authority` and `Host` headers early in the HTTP/2 transport layer.
Impact:
An attacker can cause a complete outage of the gRPC server by sending a single crafted request, provided they can successfully establish a transport connection. This results in a Denial of Service (DoS) condition affecting all services hosted on the vulnerable server.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
