GO-2026-6443 Server panic via missing authority or Host headers in google.golang.org/grpc

In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice,...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host...