SB2026111227 - Improper Validation of Array Index in gRPC-go

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111227

SB2026111227 - Improper Validation of Array Index in gRPC-go

Published: November 12, 2026

Security Bulletin ID SB2026111227
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Validation of Array Index (CVE-ID: CVE-2026-84445)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating the gRPC-Go server process.

The vulnerability exists due to improper array index validation in the xDS routing interceptor installed by xds.NewGRPCServer() when accessing the first element of an empty authorities slice, triggering an unrecovered panic. A remote attacker can send a request missing both :authority and Host headers after establishing an HTTP/2 transport connection, requiring valid transport credentials if mTLS or ALTS is enforced, to crash the server.


Remediation

Install update from vendor's website.

References