It must be mentioned again how speedy KrakenD folks are to responding and how helpful it is. It feels like we're working with a team that works here in Paylocity
Dannie Walker
Senior Software Engineer / Paylocity
CVE-2026-84445
CVE
High
False Positivegrpc server builds a plain grpc-go
server and resolves methods from its own catalog, so the xDS routing interceptor that
dereferences the empty authorities slice is never registered and the panic is
unreachable. The backend/grpc client and the OTLP/gRPC exporter of
telemetry/opentelemetry act as clients and never evaluate xDS routes either. The
dependency was upgraded as a precaution.Addressed through routine dependency maintenance in EE 2.13.10.
Component
gRPC for Go (grpc-go)
Disclosed
Sep 14, 2026
xds.NewGRPCServer() picks the virtual host for each request
by reading its :authority header. The HTTP/2 transport accepted requests that carried
neither :authority nor Host, and the xDS routing interceptor then read the first
element of an empty slice of authorities. The resulting index-out-of-range panic is not
recovered by the per-RPC goroutine, so a single crafted request terminates the whole
server process, a remote denial of service. Any peer that completes the transport
handshake can send it. grpc-go 1.83.2 rejects requests missing both headers at the
transport layer, matching the behaviour of the other gRPC implementations.Stay up to date with KrakenD releases and important updates