Bug 2533175 (CVE-2026-84445) - CVE-2026-84445 google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
Summary: CVE-2026-84445 google.golang.org/grpc: gRPC-Go: Denial of Service via malform...
Keywords:
Status: NEW
Alias: CVE-2026-84445
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-14 16:23 UTC by OSIDB Bzimport
Modified: 2026-11-03 18:22 UTC (History)
198 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:72275 0 None None None 2026-09-28 04:10:14 UTC
Red Hat Product Errata RHSA-2026:73915 0 None None None 2026-09-30 11:56:27 UTC
Red Hat Product Errata RHSA-2026:75689 0 None None None 2026-10-05 08:45:09 UTC
Red Hat Product Errata RHSA-2026:76743 0 None None None 2026-10-06 14:47:14 UTC
Red Hat Product Errata RHSA-2026:76744 0 None None None 2026-10-07 14:31:55 UTC
Red Hat Product Errata RHSA-2026:79010 0 None None None 2026-10-08 10:08:59 UTC
Red Hat Product Errata RHSA-2026:79011 0 None None None 2026-10-08 09:54:40 UTC
Red Hat Product Errata RHSA-2026:79012 0 None None None 2026-10-08 09:28:56 UTC
Red Hat Product Errata RHSA-2026:82342 0 None None None 2026-10-13 17:13:17 UTC
Red Hat Product Errata RHSA-2026:82344 0 None None None 2026-10-13 17:08:01 UTC
Red Hat Product Errata RHSA-2026:82346 0 None None None 2026-10-13 17:09:57 UTC
Red Hat Product Errata RHSA-2026:91587 0 None None None 2026-10-28 07:37:23 UTC
Red Hat Product Errata RHSA-2026:91646 0 None None None 2026-10-28 11:33:25 UTC
Red Hat Product Errata RHSA-2026:91958 0 None None None 2026-10-28 15:56:31 UTC
Red Hat Product Errata RHSA-2026:92372 0 None None None 2026-10-29 14:21:29 UTC
Red Hat Product Errata RHSA-2026:92858 0 None None None 2026-10-29 21:37:42 UTC
Red Hat Product Errata RHSA-2026:92859 0 None None None 2026-10-29 21:40:05 UTC
Red Hat Product Errata RHSA-2026:92860 0 None None None 2026-10-29 21:36:23 UTC
Red Hat Product Errata RHSA-2026:94632 0 None None None 2026-11-03 18:22:19 UTC

Description OSIDB Bzimport 2026-09-14 16:23:37 UTC 
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
Comment 6 Jon Orris 2026-09-28 04:10:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:72275 https://access.redhat.com/errata/RHSA-2026:72275
Comment 10 Jon Orris 2026-09-30 11:56:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:73915 https://access.redhat.com/errata/RHSA-2026:73915
Comment 11 Jon Orris 2026-10-05 08:44:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:75689 https://access.redhat.com/errata/RHSA-2026:75689
Comment 12 Jon Orris 2026-10-06 14:47:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:76743 https://access.redhat.com/errata/RHSA-2026:76743
Comment 13 Jon Orris 2026-10-07 14:31:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:76744 https://access.redhat.com/errata/RHSA-2026:76744
Comment 14 Jon Orris 2026-10-08 09:28:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:79012 https://access.redhat.com/errata/RHSA-2026:79012
Comment 15 Jon Orris 2026-10-08 09:54:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:79011 https://access.redhat.com/errata/RHSA-2026:79011
Comment 16 Jon Orris 2026-10-08 10:08:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:79010 https://access.redhat.com/errata/RHSA-2026:79010
Comment 17 Jon Orris 2026-10-13 17:07:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:82344 https://access.redhat.com/errata/RHSA-2026:82344
Comment 18 Jon Orris 2026-10-13 17:09:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:82346 https://access.redhat.com/errata/RHSA-2026:82346
Comment 19 Jon Orris 2026-10-13 17:13:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:82342 https://access.redhat.com/errata/RHSA-2026:82342
Comment 30 Jon Orris 2026-10-28 07:37:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:91587 https://access.redhat.com/errata/RHSA-2026:91587
Comment 31 Jon Orris 2026-10-28 11:33:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:91646 https://access.redhat.com/errata/RHSA-2026:91646
Comment 32 Jon Orris 2026-10-28 15:56:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:91958 https://access.redhat.com/errata/RHSA-2026:91958
Comment 33 Jon Orris 2026-10-29 14:21:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:92372 https://access.redhat.com/errata/RHSA-2026:92372
Comment 35 Jon Orris 2026-10-29 21:36:08 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:92860 https://access.redhat.com/errata/RHSA-2026:92860
Comment 36 Jon Orris 2026-10-29 21:37:30 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:92858 https://access.redhat.com/errata/RHSA-2026:92858
Comment 37 Jon Orris 2026-10-29 21:39:54 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:92859 https://access.redhat.com/errata/RHSA-2026:92859
Comment 39 Jon Orris 2026-11-03 18:22:10 UTC 
This issue has been addressed in the following products:

  RHEM 1.2 for RHEL 10
  RHEM 1.2 for RHEL 9

Via RHSA-2026:94632 https://access.redhat.com/errata/RHSA-2026:94632
Note You need to log in before you can comment on or make changes to this bug.