UNKNOWN Go
Server panic via missing authority or Host headers in google.golang.org/grpc
GO-2026-6443 · CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.
Ready to move
Start Securing
Free, no credit card | First findings in minutes