CVE-2026-84445
CVE
High
False Positivegrpc: xDS Server Panic via Missing Authority and Host Headers
This advisory does not affect KrakenD
KrakenD does not consume xDS. The Enterprise
grpc server builds a plain grpc-go
server and resolves methods from its own catalog, so the xDS routing interceptor that
dereferences the empty authorities slice is never registered and the panic is
unreachable. The backend/grpc client and the OTLP/gRPC exporter of
telemetry/opentelemetry act as clients and never evaluate xDS routes either. The
dependency was upgraded as a precaution.Addressed through routine dependency maintenance in EE 2.13.10.
Component
gRPC for Go (grpc-go)
Disclosed
Sep 14, 2026
Description
A gRPC server built with
xds.NewGRPCServer() picks the virtual host for each request
by reading its :authority header. The HTTP/2 transport accepted requests that carried
neither :authority nor Host, and the xDS routing interceptor then read the first
element of an empty slice of authorities. The resulting index-out-of-range panic is not
recovered by the per-RPC goroutine, so a single crafted request terminates the whole
server process, a remote denial of service. Any peer that completes the transport
handshake can send it. grpc-go 1.83.2 rejects requests missing both headers at the
transport layer, matching the behaviour of the other gRPC implementations.