chore: upgrade google.golang.org/grpc to v1.83.2 for CVE-2026-84445 - #26
Merged
Conversation
Addresses CVE-2026-84445 (HIGH): gRPC-Go xDS servers can be crashed by a request missing both `:authority` and `Host` headers, causing a DoS. Patched in grpc-go v1.83.2. The upgrade also pulls forward the minimum module requirements declared by grpc v1.83.2: golang.org/x/net v0.58.0, golang.org/x/crypto v0.55.0 and golang.org/x/text v0.41.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
brendan-kellam
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades
google.golang.org/grpcfromv1.83.1tov1.83.2to remediate CVE-2026-84445 (HIGH).gRPC-Go servers created with
xds.NewGRPCServer()install an xDS routing interceptor on every RPC. The HTTP/2 server transport previously accepted requests carrying neither:authoritynorHost, and the interceptor then indexed into an empty slice of authorities, panicking and terminating the server process (DoS). The fix inv1.83.2rejects such requests at the transport layer.Changes
google.golang.org/grpcv1.83.1→v1.83.2(patched floor from the advisory)v1.83.2, viago mod tidy:golang.org/x/netv0.57.0→v0.58.0golang.org/x/cryptov0.54.0→v0.55.0(indirect)golang.org/x/textv0.40.0→v0.41.0(indirect)No source changes were needed.
Verification
go list -m google.golang.org/grpcresolves tov1.83.2, so no affected version remains in the module graph.go build ./...— clean.go test ./... -short— passes except for the pre-existinginternal/e2escoring failures (TestBM25,TestJava,TestKotlin,TestCpp,TestPython,TestRuby,TestScala,TestGo,TestRepoRanks). These fail identically on the base commitf066712in this environment (symbol scoring depends on ctags) and are unrelated to this upgrade.go vet ./...— only pre-existing findings in untouched first-party code (cmd/zoekt-sourcegraph-indexserver/main.go,index/*_test.go).Fixes SOU-2198
🤖 Generated with Claude Code
Note
Low Risk
Patch-level dependency upgrade with no source changes; low risk aside from normal grpc/x/net transitive behavior changes.
Overview
Bumps
google.golang.org/grpcfromv1.83.1tov1.83.2to address CVE-2026-84445 (server DoS when xDS-enabled gRPC accepts HTTP/2 requests without:authorityorHost). There are no first-party code changes—onlygo.mod/go.sum.go mod tidyalso raises minimum versions pulled in by the new grpc release:golang.org/x/netv0.58.0, and indirectgolang.org/x/cryptov0.55.0andgolang.org/x/textv0.41.0.Reviewed by Cursor Bugbot for commit f5691f3. Bugbot is set up for automated code reviews on this repo. Configure here.