CVE-2026-84445

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,310; of 17,803 indexed, latest versions
Container images: 2,803; deployed by those charts
Fix available: 1 of 1; affected package

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Carried by container images the latest versions of 2,310 of 17,803 indexed charts deploy, on 2,803 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+117 more	1.82.2, 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e	2,803

OSV records: GHSA-2v4p-qf9q-27wj
Also known as: GO-2026-6443
Trending: Rank 10 in indexed charts, since 9 Sept 2026. See the ranking →

Charts affected

2,310 by stars

Chart

Latest

Affected images

Radar Score

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,623

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.82.2

Open the chart page →

1,060

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

13,875

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.82.2

Open the chart page →

402

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.82.2
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.82.2

Open the chart page →

9,426

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.82.2

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.82.2
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.82.2
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.82.2
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.82.2

Open the chart page →

8,000

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.82.2
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.82.2
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.82.2

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.82.2
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

5,076

Container images carrying it

2,803 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/conductionnl/brpservice-php :latest	c17f1ba17d36	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/contactcatalogus-php :latest	eeb625bd660c	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/digispoof-interface-php :latest	03aba499950f	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/eav-component-php :latest	24bbca4a52a8	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/education-component-php :latest	da6b05a1a601	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/eherkenning-ui-php :latest	deed102b4255	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/grafregistratiecomponent-php :latest	35225eaa87ab	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/instemmingservice-php :latest	4ffe222b3e3a	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/landelijketabellencatalogus-php :latest	26d91dcbba56	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/loggingcomponent-php :latest	834b8e1af290	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/logicservice-php :latest	72aae2080595	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/medewerkercatalogus-php :latest	1ea5412bed26	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/memo-component-php :latest	ef77f4c089a1	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/notification-component-php :latest	cd9656e6bc2c	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/orderregistratiecomponent-php :latest	d17257e4fa27	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/procestypecatalogus-php :latest	956c4fb64796	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/productenendienstencatalogus-php :latest	7242da105081	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/proto-component-commonground-php :latest	eb36ead1954e	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/review-component-php :latest	afe623824b82	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/waardepapieren-php :latest	b2666ffcbad8	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/waardepapieren-register-php :latest	9affab218351	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/containeroo/agent-forge-operator :v1.1.4	8f6d8acd134a	google.golang.org/grpc@v1.82.1	1.82.2	1
ghcr.io/containeroo/autovpa :v0.0.34	25b801d8d1f7	google.golang.org/grpc@v1.79.3	1.82.2	1
ghcr.io/containeroo/cert-manager-webhook-bluecat :latest	96f82d5840d4	google.golang.org/grpc@v1.82.1	1.82.2	1
ghcr.io/containeroo/kube-ephemeral-container-exporter :v0.0.14	b238f3c58d83	google.golang.org/grpc@v1.79.3	1.82.2	1
ghcr.io/containers/kubernetes-mcp-server :v0.0.66	6d650f4bd6ac	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-memory-policy :v0.14.0	531d21ec4ba2	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-memory-qos :v0.14.0	c7c5c24ed894	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-memtierd :v0.14.0	9138314e12ba	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-resctrl-mon :v0.14.0	a9c9775fab70	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-resource-policy-balloons :v0.14.0	a8c8297c7274	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-resource-policy-template :v0.14.0	0edfc075277b	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-resource-policy-topology-aware :v0.14.0	e2443833726a	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-sgx-epc :v0.14.0	b4c4d0d83c14	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/coollabsio/minio :RELEASE.2025-10-15T17-29-55Z	69b55a1c1c5d	google.golang.org/grpc@v1.71.0	1.82.2	1
ghcr.io/cosanet/cosanet :1.0.0	98cb5d9fa215	google.golang.org/grpc@v1.75.0	1.82.2	1
ghcr.io/crashappsec/chalk-operator :v0.1.1	28eee62e9bfa	google.golang.org/grpc@v1.68.1	1.82.2	1
ghcr.io/crashappsec/chalkular-controller :v0.0.8	d31986456626	google.golang.org/grpc@v1.83.0	1.83.2	1
ghcr.io/crashappsec/ocular-controller :v0.4.1	22060cf61e0e	google.golang.org/grpc@v1.83.0	1.83.2	1
ghcr.io/crazygit/cert-manager-alidns-webhook :0.1.4	976be6506eb6	google.golang.org/grpc@v1.75.1	1.82.2	1