chore(deps): update module google.golang.org/grpc to v1.83.2 [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/grpc	indirect	patch	v1.83.1 -> v1.83.2

---

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

• Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
• mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

High

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
• https://github.com/grpc/grpc-go/issues/9354
• https://github.com/grpc/grpc-go/pull/9365
• https://github.com/grpc/grpc-go/pull/9366
• https://github.com/grpc/grpc-go/pull/9367
• https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7
• https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4
• https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.82.2
• https://github.com/grpc/grpc-go/releases/tag/v1.83.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.2: Release 1.83.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (https://github.com/grpc/grpc-go/pull/9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

✅ Approve — automated review

The patch cleanly updates gRPC from v1.83.1 to v1.83.2 with matching module checksums. No regressions are evident in the dependency-only change.

No findings.

[shipfox-ai]

This PR is a minimal, Renovate-generated security bump of the transitive dependency google.golang.org/grpc from v1.83.1 to v1.83.2, remediating the gRPC-Go xDS server DoS vulnerability (CVE-2026-84445 / GHSA-2v4p-qf9q-27wj). I independently verified every claim in both review reports against the diff and the checked-out code: go.mod:222 now pins google.golang.org/grpc v1.83.2 // indirect (the // indirect marker correctly retained), and go.sum:558-559 carries the matching h1: and /go.mod hashes for v1.83.2, with no v1.83.1 remnants anywhere. The change touches only these two files (+3/−3), exactly as the dependency update requires. The target version matches the patched release backport named in the advisory, the bump does not conflict with renovate.json ignoreDeps, and no source code is changed. An additional check beyond both reports confirms no code in this repository imports google.golang.org/grpc directly (it is fully transitive, consistent with the // indirect marker) and nothing instantiates the affected xds.NewGRPCServer path, so the vulnerable code is not reachable here. Both the Standards and Spec axes are clean.

Recommendation: approve.

Standards

No confirmed material finding. The diff contains no executable code, so no smell (Mysterious Name, Duplicated Code, Data Clump, Primitive Obsession, Repeated Switches, Speculative Generality, Message Chains, Middle Man, Refused Bequest, Shotgun Surgery, Divergent Change) can arise. The go.mod/go.sum change is exactly the canonical shape go mod tidy produces for a version bump: the // indirect role is preserved, and both go.sum hash lines travel together in lockstep with the go.mod pin. Tooling-enforced properties (tidiness, lint, tests) are left to CI per the review brief.

Spec

No confirmed material finding. The PR body specifies exactly google.golang.org/grpc / indirect / patch / v1.83.1 -> v1.83.2, verified at go.mod:222 and go.sum:558-559, with both the h1: and /go.mod hashes for v1.83.2 (EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= and YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=) replacing the v1.83.1 pair — a complete, internally consistent bump rather than a half-applied edit. v1.83.2 is the correct remediation version for the 1.83 series per the advisory, and the fix itself lives in the grpc-go module, so no repo-side code changes are expected or made. No scope creep: nothing outside the two grpc dependency lines is modified. renovate.json ignoreDeps lists only github.com/formancehq/auth/pkg/client and github.com/oauth2-proxy/mockoidc, so the bump is consistent with the repo's Renovate configuration.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.