[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/grpc	indirect	patch	v1.83.1 → v1.83.2

---

Server panic via missing authority or Host headers in google.golang.org/grpc

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj / GO-2026-6443

More information

Details

In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.

Severity

Unknown

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
• https://github.com/grpc/grpc-go/issues/9354
• https://github.com/grpc/grpc-go/pull/9365

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj / GO-2026-6443

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

• Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
• mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.84.0, 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
• https://nvd.nist.gov/vuln/detail/CVE-2026-84445
• https://github.com/grpc/grpc-go/issues/9354
• https://github.com/grpc/grpc-go/pull/9365
• https://github.com/grpc/grpc-go/pull/9366
• https://github.com/grpc/grpc-go/pull/9367
• https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7
• https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4
• https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.82.2
• https://github.com/grpc/grpc-go/releases/tag/v1.83.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.2: Release 1.83.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#​9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/formancehq/go-libs/v5@v5.1.1-0.20260522083443-d2a60ed2e0dd: invalid version: unknown revision d2a60ed2e0dd

File name: undefined

Command failed: /bin/sh -c just pre-commit
go: downloading github.com/uptrace/bun v1.2.18
go: downloading go.temporal.io/sdk v1.41.1
go: downloading go.temporal.io/api v1.62.5
go: downloading github.com/spf13/cobra v1.10.2
go: downloading golang.org/x/oauth2 v0.35.0
go: downloading github.com/formancehq/go-libs/v5 v5.1.1-0.20260522083443-d2a60ed2e0dd
go: downloading go.uber.org/mock v0.6.0
go: downloading go.opentelemetry.io/otel/trace v1.43.0
go: downloading go.uber.org/zap v1.27.1
go: downloading golang.org/x/crypto v0.50.0
go: downloading github.com/sirupsen/logrus v1.9.4
go: downloading github.com/aws/aws-sdk-go-v2 v1.41.5
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.12
go: downloading github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.20
go: downloading github.com/uptrace/bun/dialect/pgdialect v1.2.18
go: downloading github.com/uptrace/bun/extra/bunotel v1.2.18
go: downloading github.com/xo/dburl v0.24.2
go: downloading github.com/golang-jwt/jwt/v5 v5.3.1
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.66.0
go: downloading go.opentelemetry.io/contrib/instrumentation/host v0.66.0
go: downloading go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0
go: downloading go.opentelemetry.io/contrib/propagators/b3 v1.41.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.41.0
go: downloading go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.41.0
go: downloading go.opentelemetry.io/otel/metric v1.43.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.43.0
go: downloading go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.41.0
go: downloading github.com/IBM/sarama v1.46.3
go: downloading github.com/ThreeDotsLabs/watermill-kafka/v3 v3.1.2
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.12
go: downloading github.com/aws/aws-sdk-go-v2/service/sns v1.39.14
go: downloading github.com/aws/aws-sdk-go-v2/service/sqs v1.42.24
go: downloading github.com/aws/smithy-go v1.24.2
go: downloading github.com/nats-io/nats.go v1.49.0
go: downloading github.com/xdg-go/scram v1.2.0
go: downloading go.temporal.io/sdk/contrib/opentelemetry v0.7.0
go: downloading github.com/nexus-rpc/sdk-go v0.6.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9
go: downloading github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3
go: downloading golang.org/x/sync v0.20.0
go: downloading golang.org/x/time v0.15.0
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.8
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.13
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.41.9
go: downloading filippo.io/edwards25519 v1.2.0
go: downloading github.com/shirou/gopsutil/v4 v4.26.2
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21
go: downloading github.com/pierrec/lz4/v4 v4.1.26
go: downloading github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9
go: downloading github.com/mailru/easyjson v0.9.2
go: downloading github.com/nats-io/nkeys v0.4.15
go: downloading go.opentelemetry.io/otel/log v0.17.0
go: downloading github.com/stretchr/objx v0.5.3
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21
go: downloading github.com/tklauser/go-sysconf v0.3.16
go: downloading github.com/ajg/form v1.7.1
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21
go: downloading github.com/tklauser/numcpus v0.11.0
go: downloading go.opentelemetry.io/otel v1.44.0
go: downloading github.com/formancehq/go-libs/v5 v5.1.1-0.20260522083443-d2a60ed2e0dd
go: downloading golang.org/x/text v0.41.0
go: downloading golang.org/x/sys v0.44.0
go: downloading github.com/onsi/gomega v1.39.1
go: downloading github.com/ory/dockertest/v3 v3.12.0
go: downloading github.com/onsi/ginkgo/v2 v2.28.1
go: downloading github.com/go-logr/logr v1.4.3
go: downloading go.opentelemetry.io/proto/otlp v1.10.0
go: downloading github.com/docker/cli v29.3.0+incompatible
go: downloading github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88
go: downloading github.com/containerd/continuity v0.4.5
go: downloading github.com/go-viper/mapstructure/v2 v2.5.0
go: downloading github.com/ebitengine/purego v0.10.0
go: downloading github.com/Masterminds/semver/v3 v3.4.0
go: downloading golang.org/x/tools v0.43.0
go: downloading github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc
go: downloading golang.org/x/mod v0.40.0
go: github.com/formancehq/go-libs/v5@v5.1.1-0.20260522083443-d2a60ed2e0dd: invalid version: unknown revision d2a60ed2e0dd
error: recipe `tidy` failed on line 13 with exit code 1

[NumaryBot]

🟠 [major] Commit checksum artifacts for the updated gRPC dependency

The requirement now selects gRPC v1.83.2, but go.sum still contains only v1.80.0 entries (lines 614–615). A clean build using read-only module resolution cannot resolve the updated dependency without missing-checksum errors; artifact regeneration also leaves the committed tree dirty. The discussion confirms that artifact generation failed.

Suggestion: Restore dependency resolution, regenerate go.sum for v1.83.2, and commit the resulting artifacts after validating pre-commit and tests.

[NumaryBot]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

[shipfox-ai]

Shipfox could not fix this CI failure in the repository, so it left the branch unchanged.

Failed run: Default on b6eeb864850890a46d1a20f16bacf9e9c118e982

Failing job: Dirty in the Default workflow (run 41901470224) — the only failed job; Tests, GoReleaser and Deploy were skipped because they depend on Dirty.

Root cause: the dev shell's golangci-lint (v2.6.0, built with Go 1.25.2, from the nixpkgs snapshot pinned in flake.lock) refuses to lint a project targeting Go 1.26.0. Decisive CI log lines from the Dirty job: go: module golang.org/x/net@v0.62.0 requires go >= 1.26.0; switching to go1.26.10 followed by Error: can't load config: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.0) and Recipe 'lint' failed on line 10 with exit code 3. The go 1.26.0 target that golangci-lint reads comes from go mod tidy itself: because golang.org/x/net v0.62.0 requires Go ≥ 1.26.0, tidy auto-switches to go1.26.10 (GOTOOLCHAIN=auto) and rewrites the go directive in go.mod from 1.25.0 to 1.26.0 before just lint runs.

This update did not cause it: PR #248's diff is a single line (google.golang.org/grpc v1.83.1 → v1.83.2), which does not change any Go version requirement. x/net v0.62.0 was introduced by the already-merged base-branch security update (commit 1b23411 / PR #242, diff shows golang.org/x/net v0.53.0 → v0.62.0). The identical Dirty failure is occurring today on the renovate PRs for every other release branch (v2.1–v2.6), confirming a repo-wide/toolchain issue, not a PR-specific one.

What was checked locally (in the repo's own nix develop --impure shell): (1) reproduced the exact CI error — setting go.mod to go 1.26.0 (what CI's tidy produces) and running the pinned golangci-lint run yields the identical message and exit code 3; (2) reproduced go mod tidy failing with github.com/formancehq/go-libs/v5@v5.1.1-0.20260522083443-d2a60ed2e0dd: invalid version: unknown revision d2a60ed2e0dd — this pinned pseudo-version no longer resolves upstream (also reported in the Renovate artifact-failure comment on this PR), so the branch can only be tidied with a warm module cache as on the CI runner.

Why no change in this repository fixes it safely here: the real fix is to move the dev toolchain to Go 1.26 (bump goVersion in flake.nix — but go_1_26 does not exist in the Nov-2025 nixpkgs pinned by flake.lock, so flake.lock would also need updating, and golangci-lint must be rebuilt with Go ≥ 1.26). That is a repo-wide dev-environment change affecting every branch, not a minimal fix for this dependency PR. Moreover, even with a Go-1.26 linter, the Dirty job's git status --porcelain check would still fail, because go mod tidy must rewrite go.mod (go directive) and go.sum (the PR added no go.sum entries for grpc v1.83.2) — and tidy cannot be run locally due to the unresolvable go-libs/v5 revision, so any committed go.mod/go.sum state would be unverifiable and likely leave the tree dirty in CI. Downgrading x/net would revert a security fix already merged into release/v2.7 and would be undone by tidy (required by go-libs/v5). Recommend fixing the toolchain bump on the base branches (or repo-wide), after which this PR should pass unchanged.

[flemzord]

Closed automatically: bulk PR cleanup