An unauthenticated remote denial of service vulnerability exists in gRPC-Go servers created with xds.NewGRPCServer, potentially causing complete service termination.

This is an improper validation of an array index (CWE-129) that results in an uncaught exception (CWE-248). The vulnerability occurs when an incoming RPC request lacks necessary headers, causing the routing logic to index an empty slice, which triggers a panic that is not recovered by the server process.

A successful exploit allows any remote, unauthenticated attacker to crash the gRPC server process, leading to a complete denial of service for all dependent applications. Given the CVSS score of 8.7, this is a high-severity risk that could cause significant operational downtime and disrupt critical business services, especially in environments where public-facing gRPC endpoints are exposed without strict mTLS.

Immediate Action: Update gRPC-Go to version 1.82.2 or 1.83.2 or later to include the necessary input validation fix.

Proactive Monitoring: Monitor server logs for frequent process restarts or panic entries related to routing errors in the gRPC stack.

Compensating Controls: Implement strict mTLS or ALTS authentication requirements for all gRPC connections, as these can prevent unauthenticated attackers from reaching the vulnerable interceptor logic.

Public Exploit Available: Unknown.

The vulnerability poses a significant risk to the availability of systems relying on gRPC-Go. Security teams should prioritize patching to the recommended versions immediately to prevent potential service disruption. If patching is not immediately feasible, ensure that network-level access controls or mutual TLS are strictly enforced to limit the exposure of the vulnerable server endpoints.