Fix possible fix(deps): google.golang.org/grpc v1.83.1 → 1.82.2, 1.83.2, 1.85.0-dev.0.202608250725… in go.mod - #421
Closed
begininvoke wants to merge 1 commit into
Conversation
…83.2, 1.85.0-dev.0.20260825072537-93e31b48545e (C
Collaborator
|
This was already fixed in #418 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Small change to
go.mod— a scan flagged the code below and it looked genuine. It is around line 1.CVE-2026-84445 (HIGH) — Remote Denial of Service in gRPC-Go xDS server routing.
The project pins
google.golang.org/grpc v1.83.1ingo.mod, which is affected. Servers built withxds.NewGRPCServer()install an xDS routing interceptor on every RPC that indexes the request's:authorityheader to select a virtual host. The HTTP/2 server transport accepted requests containing neither:authoritynorHost, so the interceptor attempted to access the first element of an empty authorities slice, triggering an index-out-of-bounds panic. Since per-RPC goroutines do not recover from panics, the entire server process terminates.Impact: An attacker who can complete a transport handshake (plaintext/TLS, or mTLS/ALTS with valid credentials) can crash the gRPC server with a single crafted request missing both
:authorityandHostheaders, causing a full service outage. If the endpoint accepts insecure or standard TLS connections, any unauthenticated remote attacker can trigger this — a high-severity availability risk.Risk level: HIGH. Note that exposure is limited to services using
xds.NewGRPCServer(); non-xDS servers are not affected by this specific code path, but the flagged dependency version should still be upgraded to clear the finding. This is a dependency-version vulnerability: the fix is a version bump ingo.mod(which also updatesgo.sum), not an application source-code change. Interim mitigations if an immediate upgrade is not possible: enforce mTLS at the transport layer and restrict network access to trusted clients only.Update google.golang.org/grpc to v1.83.2 to fix CVE-2026-84445
For reference: rule
CVE-2026-84445. Rated high.Take or leave whichever parts are useful. If this is not the right approach, closing is fine.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.