CVE-2026-84445

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,364; of 17,813 indexed, latest versions
Container images: 2,828; deployed by those charts
Fix available: 1 of 1; affected package

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Carried by container images the latest versions of 2,364 of 17,813 indexed charts deploy, on 2,828 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+117 more	1.82.2, 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e	2,828

OSV records: GHSA-2v4p-qf9q-27wj
Also known as: GO-2026-6443
Trending: Rank 40 in indexed charts, since 9 Sept 2026. See the ranking →

Charts affected

2,364 by stars

Chart

Latest

Affected images

Radar Score

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,624

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.82.2

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

13,907

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.82.2

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.82.2

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.82.2

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

4,926

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.82.2
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.82.2

Open the chart page →

9,738

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.82.2
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.82.2

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.82.2

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.82.2
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.82.2
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.82.2
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.82.2

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.82.2
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.82.2
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.82.2

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.82.2
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

5,077

Container images carrying it

2,828 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/cloudquery/cloudquery :6.40.0	40b804fce7f9	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/cloudscript-technology/dumpscript :v0.0.42-alpine-edge	fce5b6fd161c	google.golang.org/grpc@v1.76.0	1.82.2	1
ghcr.io/cloudtty/cloudshell :v0.8.10	23e8d178e02c	google.golang.org/grpc@v1.72.1	1.82.2	1
ghcr.io/cloudtty/cloudshell-operator :v0.8.10	14f036e33ef1	google.golang.org/grpc@v1.54.1	1.82.2	1
ghcr.io/clusternet/clusternet-controller-manager :v1.0.0	2ce077d3d02d	google.golang.org/grpc@v1.65.0	1.82.2	1
ghcr.io/clusternet/clusternet-hub :v1.0.0	59f75504c5d4	google.golang.org/grpc@v1.65.0	1.82.2	1
ghcr.io/clusternet/clusternet-scheduler :v1.0.0	a6ae5aff81ce	google.golang.org/grpc@v1.65.0	1.82.2	1
ghcr.io/cndoit18/lxcfs-agent :latest	154741f8596e	google.golang.org/grpc@v1.72.0	1.82.2	1
ghcr.io/cohdi/composable-resource-operator :v0.2.2	3f45bf0a1bc0	google.golang.org/grpc@v1.80.0	1.82.2	1
ghcr.io/comet-ml/opik/opik-python-backend :2.2.71	bd36d878f80d	google.golang.org/grpc@v1.80.0	1.82.2	1
ghcr.io/conductionnl/adresservice-php :latest	c5075f0320cd	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/authorization-component-php :latest	94a749392fcf	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/berichtservice-php :latest	ee6a21e66ff0	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/brpservice-php :latest	c17f1ba17d36	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/contactcatalogus-php :latest	eeb625bd660c	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/digispoof-interface-php :latest	03aba499950f	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/eav-component-php :latest	24bbca4a52a8	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/education-component-php :latest	da6b05a1a601	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/eherkenning-ui-php :latest	deed102b4255	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/grafregistratiecomponent-php :latest	35225eaa87ab	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/instemmingservice-php :latest	4ffe222b3e3a	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/landelijketabellencatalogus-php :latest	26d91dcbba56	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/loggingcomponent-php :latest	834b8e1af290	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/logicservice-php :latest	72aae2080595	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/medewerkercatalogus-php :latest	1ea5412bed26	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/memo-component-php :latest	ef77f4c089a1	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/notification-component-php :latest	cd9656e6bc2c	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/orderregistratiecomponent-php :latest	d17257e4fa27	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/procestypecatalogus-php :latest	956c4fb64796	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/productenendienstencatalogus-php :latest	7242da105081	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/proto-component-commonground-php :latest	eb36ead1954e	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/review-component-php :latest	afe623824b82	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/waardepapieren-php :latest	b2666ffcbad8	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/waardepapieren-register-php :latest	9affab218351	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	google.golang.org/grpc@v1.27.0	1.82.2	1
ghcr.io/containeroo/agent-forge-operator :v1.1.4	8f6d8acd134a	google.golang.org/grpc@v1.82.1	1.82.2	1
ghcr.io/containeroo/autovpa :v0.0.34	25b801d8d1f7	google.golang.org/grpc@v1.79.3	1.82.2	1
ghcr.io/containeroo/cert-manager-webhook-bluecat :latest	96f82d5840d4	google.golang.org/grpc@v1.82.1	1.82.2	1
ghcr.io/containeroo/kube-ephemeral-container-exporter :v0.0.14	b238f3c58d83	google.golang.org/grpc@v1.79.3	1.82.2	1
ghcr.io/containers/kubernetes-mcp-server :v0.0.66	6d650f4bd6ac	google.golang.org/grpc@v1.81.1	1.82.2	1
ghcr.io/containers/nri-plugins/nri-memory-policy :v0.14.0	531d21ec4ba2	google.golang.org/grpc@v1.81.1	1.82.2	1