CVE-2026-84445

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,364; of 17,813 indexed, latest versions
Container images: 2,828; deployed by those charts
Fix available: 1 of 1; affected package

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Carried by container images the latest versions of 2,364 of 17,813 indexed charts deploy, on 2,828 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+117 more	1.82.2, 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e	2,828

OSV records: GHSA-2v4p-qf9q-27wj
Also known as: GO-2026-6443
Trending: Rank 40 in indexed charts, since 9 Sept 2026. See the ranking →

Charts affected

2,364 by stars

Chart

Latest

Affected images

Radar Score

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,624

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.82.2

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

13,907

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.82.2

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.82.2

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.82.2

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

4,926

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.82.2
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.82.2

Open the chart page →

9,738

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.82.2
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.82.2

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.82.2

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.82.2
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.82.2
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.82.2
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.82.2

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.82.2
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.82.2
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.82.2

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.82.2
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

5,077

Container images carrying it

2,828 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
gcr.io/google-samples/microservices-demo/frontend :v0.2.3	ca5c0f0771c8	google.golang.org/grpc@v1.22.0	1.82.2	1
gcr.io/google-samples/microservices-demo/paymentservice :v0.2.3	6eb201217a8f	google.golang.org/grpc@v1.34.0	1.82.2	1
gcr.io/google-samples/microservices-demo/productcatalogservice :v0.2.3	5a4a0e54c6d0	google.golang.org/grpc@v1.22.0	1.82.2	1
gcr.io/google-samples/microservices-demo/recommendationservice :v0.2.3	5f60c4988859	google.golang.org/grpc@v1.34.0	1.82.2	1
gcr.io/google-samples/microservices-demo/shippingservice :v0.2.3	0cb1707fc503	google.golang.org/grpc@v1.22.0	1.82.2	1
gcr.io/istio-release/pilot :1.11.1	c552478f8f11	google.golang.org/grpc@v1.39.0	1.82.2	1
gcr.io/istio-release/proxyv2 :1.11.1	9538fabe49fd	google.golang.org/grpc@v1.39.0	1.82.2	1
gcr.io/istio-testing/install-cni :latest	ec6f9ea5757b	google.golang.org/grpc@v1.82.1	1.82.2	1
gcr.io/istio-testing/operator :latest	8d4576f7b98f	google.golang.org/grpc@v1.65.0	1.82.2	1
gcr.io/k8s-staging-multitenancy/hnc-manager :v1.1.0	8ab8229f6a89	google.golang.org/grpc@v1.40.0	1.82.2	1
gcr.io/kaniko-project/executor :latest	4e7a52dd1f14	google.golang.org/grpc@v1.72.1	1.82.2	1
gcr.io/kasten-images/prometheus :9.0.5	da2bf307c353	google.golang.org/grpc@v1.82.1	1.82.2	1
gcr.io/kasten-images/restorectl :8.0.14	5a0884f9a90c	google.golang.org/grpc@v1.76.0	1.82.2	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filter	d675f211a40f	google.golang.org/grpc@v1.67.1	1.82.2	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingress	ec4b544499ba	google.golang.org/grpc@v1.67.1	1.82.2	1
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_broker	395f4ff1bd34	google.golang.org/grpc@v1.67.1	1.82.2	1
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook	873b968f02b5	google.golang.org/grpc@v1.28.1	1.82.2	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.13.1	a5b041ba3c9e	google.golang.org/grpc@v1.60.1	1.82.2	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller	e70bc675f977	google.golang.org/grpc@v1.67.1	1.82.2	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.2.0	f253b82941c2	google.golang.org/grpc@v1.42.0	1.82.2	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook	7d76a6d42d13	google.golang.org/grpc@v1.67.1	1.82.2	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.2.0	a705c1ea8e9e	google.golang.org/grpc@v1.42.0	1.82.2	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.13.1	f066376eee17	google.golang.org/grpc@v1.60.1	1.82.2	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	15a601147ef4	google.golang.org/grpc@v1.71.1	1.82.2	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	197fbb71d1f1	google.golang.org/grpc@v1.42.0	1.82.2	1
gcr.io/knative-releases/knative.dev/operator/cmd/operator :v1.22.3	733f21dc06f9	google.golang.org/grpc@v1.80.0	1.82.2	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook :v1.22.3	66ae76179a80	google.golang.org/grpc@v1.80.0	1.82.2	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook	6c5c90cdf707	google.golang.org/grpc@v1.47.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	08315309da4b	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	1e3db4f2eeed	google.golang.org/grpc@v1.33.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.13.1	21f8e11a44bf	google.golang.org/grpc@v1.60.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.2.5	93ff6e693577	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	a5de0fb75046	google.golang.org/grpc@v1.28.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.10.2	c2994c2b6c2c	google.golang.org/grpc@v1.48.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.2.5	007820fdb75b	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	105bdd14ecaa	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	2ef460356b17	google.golang.org/grpc@v1.28.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.13.1	34796e9f760b	google.golang.org/grpc@v1.60.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.10.2	8319aa662b49	google.golang.org/grpc@v1.48.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	db6ceff2aab4	google.golang.org/grpc@v1.33.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa :v1.10.2	eb612b929eaa	google.golang.org/grpc@v1.48.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	30ce73388ae5	google.golang.org/grpc@v1.28.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.13.1	53d9aa4d2c7a	google.golang.org/grpc@v1.60.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.2.5	75cfdcfa050a	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.10.2	98a2cc7fd62e	google.golang.org/grpc@v1.48.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	b2cd45b8a8a4	google.golang.org/grpc@v1.33.1	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	bac158dfb0c7	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping :v1.2.5	23baa1932232	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping	e384a295069b	google.golang.org/grpc@v1.44.0	1.82.2	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping :v1.10.2	f66c41ad7a73	google.golang.org/grpc@v1.48.0	1.82.2	1