Logo
Retour à la veille

CVE-2026-84445

Publié : 14 septembre 2026
Modifié : 14 septembre 2026
Lien officiel NVD

Description détaillée

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.

Références et Patchs

https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297fhttps://github.com/grpc/grpc-go/issues/9354https://github.com/grpc/grpc-go/pull/9365https://github.com/grpc/grpc-go/pull/9366https://github.com/grpc/grpc-go/pull/9367https://github.com/grpc/grpc-go/releases/tag/v1.82.2https://github.com/grpc/grpc-go/releases/tag/v1.83.2https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj

Dernières Vulnérabilités

CVE-2026-91081

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.

VOIR DÉTAILS

CVE-2026-91080

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

VOIR DÉTAILS

CVE-2026-91079

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

VOIR DÉTAILS