chore(deps): update module google.golang.org/grpc to v1.83.1 [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/grpc	indirect	minor	v1.82.1 -> v1.83.1

---

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

CVE-2026-84304 / GHSA-vp52-pcj8-j9qc

More information

Details

Impact

An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.

Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).

Patches

The change to fix this issue is merged in master and a patch release, 1.83.1, has been published that contains this fix.

Workarounds

This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.

This behavior is enabled by default. A temporary escape hatch is provided via the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false to disable the feature if unforeseen issues arise, but it will be removed in a future release.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc
• https://nvd.nist.gov/vuln/detail/CVE-2026-84304
• https://github.com/grpc/grpc-go/pull/9331
• https://github.com/grpc/grpc-go/pull/9333
• https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176
• https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.83.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.1: Release 1.83.1

Compare Source

Security

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#​9332)
  • Special Thanks: @​alimony

Performance

• transport: Restrict memory overhead of buffering small data frames. (#​9331)

v1.83.0: Release 1.83.0

Compare Source

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#​9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#​9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#​9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#​9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#​9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#​9151)
• xds: Add support for contains_match in route header matchers. (#​9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#​9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#​9255)
  • Special Thanks: @​Yusufihsangorgel

v1.82.2: Release 1.82.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (https://github.com/grpc/grpc-go/pull/9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk/metric	v1.43.0 -> v1.44.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260414002931-afd174a4e478 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260414002931-afd174a4e478 -> v0.0.0-20260526163538-3dc84a4a5aaa

[NumaryBot]

✅ Approve — automated review

The dependency and checksum updates are internally consistent, and no breaking code changes or actionable defects were identified.

No findings.

[shipfox-ai]

Final review — PR #124: update google.golang.org/grpc to v1.83.1 [security]

This is a Renovate-generated, dependency-only change touching go.mod/go.sum, with no first-party source modifications. I verified the checked-out head against the claims in both reviews: google.golang.org/grpc is pinned to v1.83.1 (go.mod:240, go.sum:639-640), genproto/googleapis/api and .../rpc move to 20260526... (go.mod:238-239), and otel/sdk/otel/sdk/metric move to v1.44.0 (go.mod:220-221). The module graph is internally consistent — go.sum carries exactly one grpc version with both the h1: and /go.mod checksums and no stale/duplicate entries — and grpc is an indirect, client-only dependency (// indirect at go.mod:240; no grpc.NewServer/service registration exists in the codebase). Recommendation: approve.

Confirmed findings

No material finding was confirmed. Both reviewers correctly reported no blocking issues, and their remaining notes are informational rather than defects:

• Reviewer A's note that go.opentelemetry.io/otel/metric/x v0.66.0 appears in go.sum:532-533 but not in go.mod is expected behavior — go.sum records checksums for the full transitive build graph, so this is not an error.
• Reviewer A's severity-context note (grpc used as a client, not an inbound server, lowering real-world DoS exposure) is accurate but is commentary, not a code issue.

Note (process, non-blocking): no Go toolchain is available in this environment, so go mod verify/go mod tidy and a build could not be run locally. The manual consistency checks above passed; standard practice is to let CI's build + go mod tidy gate confirm before auto-merge.

Reviewed by Claude (claude-opus-4.8) and Codex (gpt-5.6-sol) via Shipfox; verified and synthesized by Claude.