Update module google.golang.org/grpc to v1.83.1 [SECURITY] - #452
Open
renovate-rancher[bot] wants to merge 1 commit into
Open
Update module google.golang.org/grpc to v1.83.1 [SECURITY]#452renovate-rancher[bot] wants to merge 1 commit into
renovate-rancher[bot] wants to merge 1 commit into
Conversation
renovate-rancher
Bot
added
the
dependencies
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.82.1→v1.83.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
CVE-2026-84304 / GHSA-vp52-pcj8-j9qc
More information
Details
Impact
An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.
Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).
Patches
The change to fix this issue is merged in
masterand a patch release, 1.83.1, has been published that contains this fix.Workarounds
This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.
This behavior is enabled by default. A temporary escape hatch is provided via the environment variable
GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=falseto disable the feature if unforeseen issues arise, but it will be removed in a future release.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing
:authorityandHostheadersCVE-2026-84445 / GHSA-2v4p-qf9q-27wj
More information
Details
A vulnerability exists in gRPC-Go servers configured with
xds.NewGRPCServer()where a crafted request missing both:authorityandHostheaders can cause a server panic, resulting in a Denial of Service (DoS).Servers built with
xds.NewGRPCServerinstall an xDS routing interceptor on every RPC. This interceptor looks up the request’s:authorityheader to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither:authoritynorHost. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.
Impact
An attacker can cause a complete outage of the gRPC server by sending a request missing both
:authorityandHostheaders, provided they can successfully establish a transport connection.Patches
The issue has been addressed in
master(and backported to1.83.2and1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both:authorityandHostheaders early, maintaining consistency with and other gRPC language implementations.Severity
High
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
CVE-2026-84303 / GHSA-qc2q-p7wx-3px3
More information
Details
Summary
A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).
Impact
When an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing specific header values fails open: the rule is evaluated as a non-match, and traffic that should have been rejected is served.
Furthermore, gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-. Because this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status.
Patches
The problem is fixed in
masterand in the 1.83.1 release.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
CVE-2026-84304 / GHSA-vp52-pcj8-j9qc
More information
Details
Impact
An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.
Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).
Patches
The change to fix this issue is merged in
masterand a patch release, 1.83.1, has been published that contains this fix.Workarounds
This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.
This behavior is enabled by default. A temporary escape hatch is provided via the environment variable
GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=falseto disable the feature if unforeseen issues arise, but it will be removed in a future release.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
grpc/grpc-go (google.golang.org/grpc)
v1.83.1: Release 1.83.1Compare Source
Security
PrincipalorPermissionrules with:schemeorgrpc-prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)hostheader matcher was not being replaced with:authorityin nestedPrincipalorPermissionrules. (#9258)X-Role, matched no header, which could cause DENY rules to fail open. (#9332):schemeorgrpc-prefixed header matcher was accepted when its name was not lowercase. (#9332)Hostheader matcher was not replaced with:authority. (#9332)Performance
v1.83.0: Release 1.83.0Compare Source
Security
GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.MetadataandRequestedServerNamepermissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.NotRule/NotIdpermissions.source_ipprincipal identifier by treating it as equivalent todirect_remote_ip.exact_match,prefix_match, orsuffix_matchstrings. (#9223)New Features
force-xdstarget URI query parameter. (#9133)OnPolicyUpdatecallback toFileWatcherOptionsto notify when an authz policy is loaded or updated. (#9142)GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)contains_matchin route header matchers. (#9223)Bug Fixes
GOOS=plan9), broken since v1.81.0. (#9255)v1.82.2: Release 1.82.2Compare Source
Security
:authorityandHostheaders with HTTP 400 and statusInternal. (#9365)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.