CVE-2026-84445

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,364; of 17,813 indexed, latest versions
Container images: 2,828; deployed by those charts
Fix available: 1 of 1; affected package

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

Carried by container images the latest versions of 2,364 of 17,813 indexed charts deploy, on 2,828 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+117 more	1.82.2, 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e	2,828

OSV records: GHSA-2v4p-qf9q-27wj
Also known as: GO-2026-6443
Trending: Rank 40 in indexed charts, since 9 Sept 2026. See the ranking →

Charts affected

2,364 by stars

Chart

Latest

Affected images

Radar Score

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

2,624

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.82.2

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

13,907

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.82.2

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.82.2

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.82.2

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.82.2

Open the chart page →

4,926

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.82.2
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.82.2

Open the chart page →

9,738

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.82.2
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.82.2

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.82.2

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.82.2
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.82.2
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.82.2
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.82.2

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.82.2
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.82.2
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.82.2

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84445.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.82.2
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.82.2

Open the chart page →

5,077

Container images carrying it

2,828 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar :v2.14.0	6cb172e3de7e	google.golang.org/grpc@v1.72.1	1.82.2	1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar :v2.16.0	b5ff0d884b68	google.golang.org/grpc@v1.83.1	1.83.2	1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-provisioner :v5.2.0	afdfa3da79df	google.golang.org/grpc@v1.69.2	1.82.2	1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-resizer :v1.13.2	fa8eba9843ff	google.golang.org/grpc@v1.69.2	1.82.2	1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-snapshotter :v8.5.0	8b3ce8339944	google.golang.org/grpc@v1.82.1	1.82.2	1
mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe :v2.15.0	59b9d0348428	google.golang.org/grpc@v1.71.0	1.82.2	1
mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver :v1.5.6	5f91243cfd60	google.golang.org/grpc@v1.56.3	1.82.2	1
mcr.microsoft.com/oss/v2/nvidia/k8s-device-plugin :v0.18.2-12	5a4e52c87bb9	google.golang.org/grpc@v1.82.1	1.82.2	1
public.ecr.aws/aktosecurity/keelhq-keel :akto_v1.0.0	1eb61443d68e	google.golang.org/grpc@v1.68.0	1.82.2	1
public.ecr.aws/aws-containers/retail-store-sample-catalog :1.3.0	b654b266fa32	google.golang.org/grpc@v1.73.0	1.82.2	1
public.ecr.aws/aws-ec2/aws-node-termination-handler-2/controller :v2.0.0-beta	9637c80dd23f	google.golang.org/grpc@v1.42.0	1.82.2	1
public.ecr.aws/aws-ec2/aws-node-termination-handler-2/webhook :v2.0.0-beta	86b0f7243250	google.golang.org/grpc@v1.42.0	1.82.2	1
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	google.golang.org/grpc@v1.69.2	1.82.2	1
public.ecr.aws/aws-observability/aws-otel-collector :v0.49.0	d2bdfff2c377	google.golang.org/grpc@v1.82.0	1.82.2	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r2-2021.08.13.20.34-linux-amd64	02aed3370fce	google.golang.org/grpc@v1.35.0	1.82.2	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r2-35-g41dc61e-2022.12.16.20.38	363bd65cd707	google.golang.org/grpc@v1.49.0	1.82.2	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r1-10-g1942553-2021.06.04.00.07-linux-amd64	b32c99e7bc45	google.golang.org/grpc@v1.35.0	1.82.2	1
public.ecr.aws/boundless-software/switchblade :release-v0.0.19-lcm	01d8413d5075	google.golang.org/grpc@v1.60.1	1.82.2	1
public.ecr.aws/buildkite/agent-metrics :v5.11.0	16e7f5c7161e	google.golang.org/grpc@v1.75.0	1.82.2	1
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-agent :0.10.2	6769c2275a43	google.golang.org/grpc@v1.73.0	1.82.2	1
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.46.0	0bbb5f5ddf71	google.golang.org/grpc@v1.79.3	1.82.2	1
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.45.0	90b890f800ab	google.golang.org/grpc@v1.67.1	1.82.2	1
public.ecr.aws/cloudnatix/llmariner/job-manager-syncer :1.27.0	86957bbeeff5	google.golang.org/grpc@v1.67.0	1.82.2	1
public.ecr.aws/cloudnatix/llmariner/session-manager-agent :1.9.0	b9f23db99051	google.golang.org/grpc@v1.67.1	1.82.2	1
public.ecr.aws/cloudnatix/llmariner/session-manager-server :0.1.0-gfu-dev	b9537499ff9e	google.golang.org/grpc@v1.67.1	1.82.2	1
public.ecr.aws/cloudnatix/llmariner/session-manager-server :1.9.0	f24ecd37fbaa	google.golang.org/grpc@v1.67.1	1.82.2	1
public.ecr.aws/cloudpilotai/gcp/karpenter :v0.6.0	aab80cfd2c4e	google.golang.org/grpc@v1.82.1	1.82.2	1
public.ecr.aws/csi-components/csi-node-driver-registrar :v2.16.0-eksbuild.3	592d7034d6c7	google.golang.org/grpc@v1.79.3	1.82.2	1
public.ecr.aws/csi-components/livenessprobe :v2.18.0-eksbuild.3	8e307f4e5820	google.golang.org/grpc@v1.79.3	1.82.2	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	google.golang.org/grpc@v1.76.0	1.82.2	1
public.ecr.aws/diagrid-dev/diagrid-dashboard :latest	f1348a65664a	google.golang.org/grpc@v1.80.0	1.82.2	1
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	google.golang.org/grpc@v1.52.3	1.82.2	1
public.ecr.aws/dynatrace/dynatrace-operator :v1.10.2	52281db48c93	google.golang.org/grpc@v1.82.1	1.82.2	1
public.ecr.aws/dynatrace/dynatrace-operator :v1.3.0	f68901a54664	google.golang.org/grpc@v1.65.0	1.82.2	1
public.ecr.aws/eks-distro/kubernetes/kube-scheduler :v1.29.14-eks-1-29-latest	e7e1db003e6a	google.golang.org/grpc@v1.59.0	1.82.2	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	google.golang.org/grpc@v1.79.3	1.82.2	1
public.ecr.aws/groundcovercom/kong/kubernetes-ingress-controller :3.5.3-20260205	bf9db911deed	google.golang.org/grpc@v1.73.0	1.82.2	1
public.ecr.aws/groundcovercom/loki-proxy :0.1.1	783d550ad813	google.golang.org/grpc@v1.44.0	1.82.2	1
public.ecr.aws/groundcovercom/temporalio/admin-tools :1.29.7-20260730-1	af8cea3b8538	google.golang.org/grpc@v1.56.3	1.82.2	1
public.ecr.aws/groundcovercom/temporalio/server :1.29.6-mini-20260702-1	70f191d0a80e	google.golang.org/grpc@v1.79.3	1.82.2	1
public.ecr.aws/k4y9r6y5/kratos :v25.4.0	e8014c6c58b6	google.golang.org/grpc@v1.74.2	1.82.2	1
public.ecr.aws/karpenter/controller :v0.19.3	f0e5ab60b2df	google.golang.org/grpc@v1.47.0	1.82.2	1
public.ecr.aws/lumigo/lumigo-kubernetes-rbac-proxy :69	6c2f0585cd6c	google.golang.org/grpc@v1.47.0	1.82.2	1
public.ecr.aws/lumigo/lumigo-kubernetes-telemetry-proxy :69	1d548e59c2c8	google.golang.org/grpc@v1.72.1	1.82.2	1
public.ecr.aws/lumigo/lumigo-kubernetes-watchdog :69	6458fcd61e0c	google.golang.org/grpc@v1.71.1	1.82.2	1
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom :v1.1.70	1afcfbc000e0	google.golang.org/grpc@v1.83.1	1.83.2	1
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom :v1.1.34	e97e0e7a2088	google.golang.org/grpc@v1.65.0	1.82.2	1
public.ecr.aws/neuron/neuron-device-plugin :2.23.30.0	75a6d5ce3bd3	google.golang.org/grpc@v1.60.1	1.82.2	1
public.ecr.aws/optimizely/webhook-broker :v0.2.3	cfc92cc2de65	google.golang.org/grpc@v1.65.0	1.82.2	1
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	google.golang.org/grpc@v1.62.1	1.82.2	1