gRPC-Go xDS Servers: DoS Vulnerability via Missing Headers
- Severity
- HIGH
- Affected component
- grpc-go (go)
- Patched version
- Not yet available
An early warning has been issued regarding a high-severity vulnerability in gRPC-Go servers configured with `xds.NewGRPCServer()`. This vulnerability can lead to a server panic and Denial of Service (DoS) when a crafted request missing both `:authority` and `Host` headers is received.
What happened
An early warning has been issued for a critical vulnerability in gRPC-Go servers that use the `xds.NewGRPCServer()` configuration. This vulnerability can cause a server to panic and result in a Denial of Service (DoS) condition when it receives a specially crafted request that lacks both the `:authority` and `Host` headers. The issue was first flagged on 2026-09-08 and is currently under investigation. No exploitation in the wild has been confirmed at this time.
The vulnerability affects the `grpc-go` component in Go applications. However, an authoritative version range has not been published yet. Users of gRPC-Go are advised to stay informed about updates from the primary sources.
What to do about it
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
- Consider upgrading to a version of gRPC-Go that includes the fix, such as `1.83.2` or `1.82.2`, if available.
- Review your application's configuration to ensure that gRPC-Go servers are not exposed to untrusted inputs that could trigger this vulnerability.
- Implement additional input validation and sanitization to mitigate the risk of receiving malicious requests.
- Stay informed about updates from the gRPC-Go project and apply patches as soon as they become available.
How 0Day would have caught this
grpc-go is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If your application uses gRPC-Go servers configured with `xds.NewGRPCServer()`, you may be affected. However, an authoritative version range has not been published yet. Consult the primary sources for the most current information.
What should I do right now?
Monitor the primary sources for updates and consider upgrading to a version of gRPC-Go that includes the fix, such as `1.83.2` or `1.82.2`, if available. Review your application's configuration and implement additional input validation.
Has an official fix been released?
No official fix has been published yet. Monitor the primary sources for updates on any released patches.