chore(deps): update module google.golang.org/grpc to v1.83.2 [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/grpc	require	patch	v1.83.1 -> v1.83.2

---

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

• Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
• mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

High

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
• https://github.com/grpc/grpc-go/issues/9354
• https://github.com/grpc/grpc-go/pull/9365
• https://github.com/grpc/grpc-go/pull/9366
• https://github.com/grpc/grpc-go/pull/9367
• https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7
• https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4
• https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.82.2
• https://github.com/grpc/grpc-go/releases/tag/v1.83.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.2: Release 1.83.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (https://github.com/grpc/grpc-go/pull/9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/net	v0.57.0 -> v0.58.0

[NumaryBot]

✅ Approve — automated review

The patch only updates gRPC to the intended security release and its resolved x/net dependency, with corresponding checksums. No breaking or incorrect changes are evident.

No findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (97b6c81) to head (1d3099f).

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #116   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files         11      11           
  Lines        682     682           
=====================================
  Misses       682     682           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[shipfox-ai]

This PR is a pure, machine-generated Renovate dependency bump: google.golang.org/grpc v1.83.1 → v1.83.2 (patch, security release for GHSA-2v4p-qf9q-27wj / CVE-2026-84445) plus the expected transitive companion bump golang.org/x/net v0.57.0 → v0.58.0, with matching go.sum checksum lines. The change touches only go.mod and go.sum (+6/−6); no Go source, build, or configuration files were modified. I verified the diff line-by-line against the actual checkout — the manifest state matches exactly — and confirmed the codebase uses gRPC only on the client side (internal/client/, internal/generated/stargate_grpc.pb.go) with no xds.NewGRPCServer usage, so the patched server-side xDS code path is not exercised here; the bump is a safe, defensive update with no compatibility risk for this module. Recommendation: approve.

Standards

No confirmed material finding. The change consists solely of manifest/checksum version strings in go.mod and go.sum; it introduces no code, so no documented-standard violation or baseline design smell can apply. The repository documents no coding standards to cite.

Spec

No confirmed material finding. The spec (Renovate PR body) requests exactly one change — google.golang.org/grpc v1.83.1 → v1.83.2 — and the diff implements it precisely, with correct go.sum checksums for both modules. The only non-listed change, the indirect golang.org/x/net v0.57.0 → v0.58.0 bump in go.mod:82, was verified to be the standard transitive companion of the grpc v1.83.2 module graph and is expected, benign behavior for an automated dependency PR — not scope creep. No missing requirements, no incorrect implementations.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.