gRPC-Go xDS Servers: DoS Vulnerability via Missing Headers
- Severity
- HIGH
- Affected component
- grpc-go (go)
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in gRPC-Go servers configured with `xds.NewGRPCServer()`. This issue can cause a server panic and Denial of Service (DoS) when a crafted request is missing both `:authority` and `Host` headers.
What happened
An early warning has been issued for a high-severity vulnerability in gRPC-Go servers that are configured using `xds.NewGRPCServer()`. This vulnerability can lead to a server panic and Denial of Service (DoS) if a crafted request is received that lacks both the `:authority` and `Host` headers. The vulnerability is currently under investigation and has not been exploited in the wild. The affected component is `grpc-go` for Go, but no authoritative version range has been published yet.
The vulnerability was first flagged on 2026-09-08T21:21:43+00:00. The GitHub Security Advisory GHSA-2v4p-qf9q-27wj provides more details on the issue. It is recommended to upgrade to a version that includes the fix, such as `1.83.2` or `1.82.2`, to mitigate the risk.
What to do about it
- Check your gRPC-Go server configuration to see if it uses `xds.NewGRPCServer()`.
- Upgrade your gRPC-Go server to version `1.83.2` or `1.82.2` to apply the fix.
- Monitor the primary sources for updates on the vulnerability and any additional fixes that may be released.
- Consider implementing additional request validation to ensure that both `:authority` and `Host` headers are present in incoming requests.
How 0Day would have caught this
grpc-go is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if your gRPC-Go server is configured with `xds.NewGRPCServer()`. However, no authoritative version range has been published yet. Consult the primary sources for the most current information.
What should I do right now?
Upgrade your gRPC-Go server to version `1.83.2` or `1.82.2` to apply the fix. Monitor the primary sources for updates on the vulnerability and any additional fixes that may be released.
Is there an official fix available?
Yes, versions `1.83.2` and `1.82.2` include the fix for this vulnerability.