chore(deps): update module google.golang.org/grpc to v1.83.2 [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/grpc	indirect	patch	v1.83.1 -> v1.83.2

---

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

• Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
• mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

High

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
• https://github.com/grpc/grpc-go/issues/9354
• https://github.com/grpc/grpc-go/pull/9365
• https://github.com/grpc/grpc-go/pull/9366
• https://github.com/grpc/grpc-go/pull/9367
• https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7
• https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4
• https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.82.2
• https://github.com/grpc/grpc-go/releases/tag/v1.83.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.2: Release 1.83.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (https://github.com/grpc/grpc-go/pull/9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

ℹ Artifact update notice

File name: tools/utils/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.56.0 -> v0.58.0
golang.org/x/sync	v0.21.0 -> v0.22.0
golang.org/x/sys	v0.46.0 -> v0.47.0
golang.org/x/text	v0.39.0 -> v0.41.0

[NumaryBot]

✅ Approve — automated review

The dependency and checksum updates are internally consistent, and no actionable regression is evident.

No findings.

[shipfox-ai]

This PR updates the indirect google.golang.org/grpc dependency from v1.83.1 to v1.83.2 (security patch for CVE-2026-84445 / GHSA-2v4p-qf9q-27wj) across the two modules that require it, deployment/operator and tools/utils. I verified against the checkout: deployment/operator/go.mod:117 and tools/utils/go.mod:83 both pin v1.83.2; deployment/operator/go.sum:344-345 and tools/utils/go.sum:237-238 carry the matching v1.83.2 h1/go.mod checksums (identical in both modules); no stale v1.83.1 entry survives anywhere; and the root module and tools/kubectl-stacks do not require grpc, so no consumer was missed. The accompanying golang.org/x/{net,sync,sys,text,mod,tools} bumps in tools/utils are the expected transitive consequence of grpc v1.83.2's requirements resolved by go mod tidy (the resulting versions match those already pinned in deployment/operator). The change is metadata-only, internally consistent, and fully implements the spec. Recommendation: approve.

Standards

No confirmed material finding. The diff touches only Go module metadata (go.mod/go.sum), so code-level smells are structurally inapplicable. Candidate observations examined and rejected: the grpc bump appearing identically in both modules is the mandated multi-module pattern (not Shotgun Surgery/Duplicated Code), and the mixed grpc + golang.org/x/* edits in tools/utils/go.mod are one logical change under Go's Minimum Version Selection (not a Divergent Change). No documented coding standard in the repo governs module metadata.

Spec

No confirmed material finding. The requested bump is fully and correctly applied: exact target version v1.83.2 in both affected modules, consistent and plausible checksums, no module skipped, no unrelated files touched. One non-blocking note: the PR body (Renovate table) lists only grpc, while tools/utils also picks up transitive golang.org/x/net v0.56.0→v0.58.0, x/sync v0.21.0→v0.22.0, x/sys v0.46.0→v0.47.0, x/text v0.39.0→v0.41.0 (go.mod), plus x/mod v0.37.0→v0.38.0 and x/tools v0.47.0→v0.48.0 (go.sum only). These are required by grpc v1.83.2's own go.mod and reconcile with versions already pinned elsewhere in the repo — expected for a Renovate Go update, no action needed.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.

[shipfox-ai]

This PR is a mechanical Renovate dependency bump: google.golang.org/grpc v1.83.1 -> v1.83.2 (security fix for CVE-2026-84445 / GHSA-2v4p-qf9q-27wj) applied consistently across the two module graphs that declare the dependency, deployment/operator and tools/utils, with matching go.mod requirements and go.sum hashes in both. I independently verified against the checkout: a repo-wide search finds no stale v1.83.1 pins, both modules resolve grpc to v1.83.2 with identical h1://go.mod hashes, and no replace directives or overrides were introduced. The additional golang.org/x/{net,sync,sys,text} bumps in tools/utils/go.mod/go.sum (plus go.sum-only hash updates for x/mod and x/tools) exactly match the versions already selected by the root module, confirming they are the expected MVS/go mod tidy realignment pulled in by the grpc update — not an unrequested upgrade; deployment/operator needed no x/* changes, which corroborates this. The vulnerable code path (xds.NewGRPCServer) is not exercised by the operator's own code, but the patch-level bump carries no compatibility risk. Recommendation: approve.

Standards

No confirmed material finding. The diff touches only generated manifest files (go.mod/go.sum) across two Go modules; the duplicated grpc hunk and the four-file shape of the change are inherent to Go's multi-module dependency declarations, not extractable logic or scattered unrelated edits. The candidate "Divergent Change" in tools/utils/go.mod was rejected after verification: the golang.org/x/* bumps are knock-on MVS effects of the grpc bump (matching the root module's existing selections), so the module is not being edited for genuinely unrelated reasons.

Spec

No confirmed material finding. The PR body requests exactly one change — google.golang.org/grpc (indirect, patch) v1.83.1 -> v1.83.2 for CVE-2026-84445 — and the diff faithfully implements it: a genuine patch bump applied everywhere the dependency is declared, hash-consistent, with no downgrades, scope creep beyond MVS-forced indirect realignments, or sneaked overrides.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.