Improper Validation of Array Index in gRPC-go - CVE-2026-84445
Published: November 12, 2026
Vulnerability identifier: #VU165958
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84445
CWE-ID: CWE-129
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by terminating the gRPC-Go server process.
The vulnerability exists due to improper array index validation in the xDS routing interceptor installed by xds.NewGRPCServer() when accessing the first element of an empty authorities slice, triggering an unrecovered panic. A remote attacker can send a request missing both :authority and Host headers after establishing an HTTP/2 transport connection, requiring valid transport credentials if mTLS or ALTS is enforced, to crash the server.
Affected software
gRPC-go
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Public Cloud Module
openSUSE Leap
terraform-provider-susepubliccloud
amazon-cloudwatch-agent
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Public Cloud Module
openSUSE Leap
terraform-provider-susepubliccloud
amazon-cloudwatch-agent
How to mitigate CVE-2026-84445
Install security update from vendor's website.
gRPC-go - update to 1.83.2
terraform-provider-susepubliccloud - update to 0.0.1-150100.3.23.1
amazon-cloudwatch-agent - update to 1.300072.0-150400.9.13.1
terraform-provider-susepubliccloud - update to 0.0.1-150100.3.23.1
amazon-cloudwatch-agent - update to 1.300072.0-150400.9.13.1