keb/lazysecrets
1
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 5 Wiki Activity

chore(deps): update module google.golang.org/grpc to v1.83.2 [security] #48

Merged
renovate-bot Bot merged 1 commits from renovate/security-fixes into main 2026-10-12 21:02:01 +02:00
Conversation 0 Commits 1 Files Changed 2
+3 -3
renovate-bot Bot commented 2026-10-12 21:01:08 +02:00
Copy link
Copy source

This PR contains the following updates:

Package Change Age Confidence
google.golang.org/grpc v1.83.1 → v1.83.2 age confidence

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj / GO-2026-6443

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

  • Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
  • mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.
Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.84.0, 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Server panic via missing authority or Host headers in google.golang.org/grpc

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj / GO-2026-6443

More information

Details

In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.2: Release 1.83.2

Compare Source

Security

  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#​9365)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.83.1` → `v1.83.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.83.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.83.1/v1.83.2?slim=true) | --- ### gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) / [GHSA-2v4p-qf9q-27wj](https://github.com/advisories/GHSA-2v4p-qf9q-27wj) / [GO-2026-6443](https://pkg.go.dev/vuln/GO-2026-6443) <details> <summary>More information</summary> #### Details A vulnerability exists in gRPC-Go servers configured with `xds.NewGRPCServer()` where a crafted request missing both `:authority` and `Host` headers can cause a server panic, resulting in a Denial of Service (DoS). Servers built with `xds.NewGRPCServer` install an xDS routing interceptor on every RPC. This interceptor looks up the request’s `:authority` header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither `:authority` nor `Host`. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate. This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic. - Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash. - mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic. ##### Impact An attacker can cause a complete outage of the gRPC server by sending a request missing both `:authority` and `Host` headers, provided they can successfully establish a transport connection. ##### Patches The issue has been addressed in `master` (and backported to `1.84.0`, `1.83.2` and `1.82.2`). The fix updates the HTTP/2 transport layer to reject requests missing both `:authority` and `Host` headers early, maintaining consistency with and other gRPC language implementations. #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X` #### References - [https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj) - [https://nvd.nist.gov/vuln/detail/CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [https://github.com/grpc/grpc-go/issues/9354](https://github.com/grpc/grpc-go/issues/9354) - [https://github.com/grpc/grpc-go/pull/9365](https://github.com/grpc/grpc-go/pull/9365) - [https://github.com/grpc/grpc-go/pull/9366](https://github.com/grpc/grpc-go/pull/9366) - [https://github.com/grpc/grpc-go/pull/9367](https://github.com/grpc/grpc-go/pull/9367) - [https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7](https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7) - [https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4](https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4) - [https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f](https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f) - [https://github.com/grpc/grpc-go](https://github.com/grpc/grpc-go) - [https://github.com/grpc/grpc-go/releases/tag/v1.82.2](https://github.com/grpc/grpc-go/releases/tag/v1.82.2) - [https://github.com/grpc/grpc-go/releases/tag/v1.83.2](https://github.com/grpc/grpc-go/releases/tag/v1.83.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2v4p-qf9q-27wj) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Server panic via missing authority or Host headers in google.golang.org/grpc [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) / [GHSA-2v4p-qf9q-27wj](https://github.com/advisories/GHSA-2v4p-qf9q-27wj) / [GO-2026-6443](https://pkg.go.dev/vuln/GO-2026-6443) <details> <summary>More information</summary> #### Details In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server. #### Severity Unknown #### References - [https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj](https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj) - [https://github.com/grpc/grpc-go/issues/9354](https://github.com/grpc/grpc-go/issues/9354) - [https://github.com/grpc/grpc-go/pull/9365](https://github.com/grpc/grpc-go/pull/9365) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6443) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.83.2`](https://github.com/grpc/grpc-go/releases/tag/v1.83.2): Release 1.83.2 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2) ### Security - server: Reject requests missing both `:authority` and `Host` headers with HTTP 400 and status `Internal`. ([#&#8203;9365](https://github.com/grpc/grpc-go/pull/9365)) - Special Thanks: [@&#8203;winklemad](https://github.com/winklemad) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate-bot Bot added 1 commit 2026-10-12 21:01:08 +02:00
chore(deps): update module google.golang.org/grpc to v1.83.2 [security]
CI / Checks (pull_request) Successful in 33s
Details
PR title / Conventional title (pull_request) Successful in 1s
Details
350c88f5c5
renovate-bot Bot scheduled this pull request to auto merge when all checks succeed 2026-10-12 21:01:09 +02:00
renovate-bot Bot merged commit 00924a4a1e into main 2026-10-12 21:02:01 +02:00
renovate-bot Bot deleted branch renovate/security-fixes 2026-10-12 21:02:01 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot Bot keb (Karl-Einar Bergstrøm)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: keb/lazysecrets#48