[main] Update module google.golang.org/grpc to v1.83.2 [SECURITY] (main) by ospk8s-renovate[bot] · Pull Request #2173 · openstack-k8s-operators/openstack-operator

ospk8s-renovate · 2026-10-13T07:43:28Z

This PR contains the following updates:

Package	Change	Age	Confidence
google.golang.org/grpc	`v1.83.1` → `v1.83.2`

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.84.0, 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj / GO-2026-6443

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.84.0, 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Server panic via missing authority or Host headers in google.golang.org/grpc

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj / GO-2026-6443

More information

Details

In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

grpc/grpc-go (google.golang.org/grpc)

`v1.83.2`: Release 1.83.2

Compare Source

Security

server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
- Special Thanks: @winklemad

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

openshift-ci · 2026-10-13T07:43:34Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ospk8s-renovate[bot]
Once this PR has been reviewed and has the lgtm label, please assign fultonj for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-10-13T07:43:39Z

Hi @ospk8s-renovate[bot]. Thanks for your PR.

I'm waiting for a openstack-k8s-operators member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2026-10-13T07:43:39Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Advanced
Run ID: 422f3729-b787-46db-9511-a744dbf61846

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-13T07:43:42Z

OpenStackControlPlane CRD Size Report

Metric	Value
CRD JSON size	338593 bytes (331KB)
Base branch size	338593 bytes
Change	+0.00%
Status	yellow — growing

Threshold reference

Color	Range	Meaning
🟢 green	< 300KB	Comfortable
🟡 yellow	300–400KB	Growing
🟠 orange	400–750KB	Concerning
🔴 red	> 750KB	Approaching 1.5MB etcd limit (cut in half to allow space for update)

centosinfra-prod-github-app · 2026-10-13T12:01:02Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/d05ed963141344638bcdf09419c8ecb7

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 54m 07s
✔️ openstack-operator-content-provider-cs10 SUCCESS in 3h 59m 11s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 17m 55s
✔️ openstack-operator-crc-podified-edpm-baremetal SUCCESS in 1h 26m 19s
✔️ podified-multinode-edpm-deployment-crc-antelope SUCCESS in 1h 18m 24s
❌ adoption-standalone-to-crc-ceph-provider FAILURE in 1h 53m 42s (non-voting)
❌ openstack-operator-tempest-multinode FAILURE in 1h 22m 51s
❌ openstack-operator-edpm-baremetal-minor-update FAILURE in 1h 59m 06s (non-voting)

[main] Update module google.golang.org/grpc to v1.83.2 [SECURITY]

17e74eb

openshift-ci Bot requested review from abays and dprince October 13, 2026 07:43

openshift-ci Bot added the needs-ok-to-test label Oct 13, 2026

Navigation Menu

Repository navigation

[main] Update module google.golang.org/grpc to v1.83.2 [SECURITY] (main) - #2173

[main] Update module google.golang.org/grpc to v1.83.2 [SECURITY] (main)#2173
ospk8s-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-osv-vulnerability-alerts

ospk8s-renovate Bot commented Oct 13, 2026

Uh oh!

openshift-ci Bot commented Oct 13, 2026

Uh oh!

openshift-ci Bot commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026

Review skipped

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Oct 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

ospk8s-renovate Bot commented Oct 13, 2026

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

Details

Impact

Patches

Severity

References

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

Details

Impact

Patches

Severity

References

Server panic via missing authority or Host headers in google.golang.org/grpc

Details

Severity

References

Release Notes

v1.83.2: Release 1.83.2

Security

Configuration

Uh oh!

openshift-ci Bot commented Oct 13, 2026

Uh oh!

openshift-ci Bot commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026

Review skipped

Uh oh!

github-actions Bot commented Oct 13, 2026

OpenStackControlPlane CRD Size Report

Uh oh!

centosinfra-prod-github-app Bot commented Oct 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

`v1.83.2`: Release 1.83.2