From 5b2ffbe0189b1594ba68f67b115743669cc79bf5 Mon Sep 17 00:00:00 2001 From: diagrawa Date: Tue, 6 Oct 2026 16:22:54 +0530 Subject: [PATCH] =?UTF-8?q?fix:=20update=20google.golang.org/grpc=20to=20v?= =?UTF-8?q?1.82.2=20=E2=80=94=20CVE-2026-84445?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upgrade google.golang.org/grpc from v1.82.1 to v1.82.2 to address CVE-2026-84445. Jira: SRVKP-14425 govulncheck scan: go1.25.13 Test result: passed Co-Assisted-By: CVE Fixer Bot --- go.mod | 2 +- go.sum | 4 ++-- .../grpc/internal/transport/http2_server.go | 6 ++++++ .../grpc/internal/xds/server/routing.go | 11 +++++++---- vendor/google.golang.org/grpc/version.go | 2 +- vendor/modules.txt | 2 +- 6 files changed, 18 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index e48adda488..8f1814f483 100644 --- a/go.mod +++ b/go.mod @@ -341,7 +341,7 @@ require ( google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260720155508-bb71a54f79dc // indirect - google.golang.org/grpc v1.82.1 // indirect + google.golang.org/grpc v1.82.2 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index 9587903b28..d008fd110d 100644 --- a/go.sum +++ b/go.sum @@ -1997,8 +1997,8 @@ google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34= google.golang.org/grpc v1.41.0/go.mod h1:U3l9uK9J0sini8mHphKoXyaqDA/8VyGnDee1zzIUK6k= google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU= -google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= -google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.82.2 h1:2+rCCTC8esfgjDFhN+rIok0FVsBLw/y5vHzNX2FjRLw= +google.golang.org/grpc v1.82.2/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go index be8ae9f9c5..8e9cbd37d8 100644 --- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go +++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go @@ -522,6 +522,12 @@ func (t *http2Server) operateHeaders(ctx context.Context, frame *http2.MetaHeade delete(mdata, "host") } + // If :authority is still missing, i.e. no host or :authority header is + // present, reject the request as invalid. + if len(mdata[":authority"]) == 0 { + t.writeEarlyAbort(streamID, s.contentSubtype, status.New(codes.Internal, "no host or :authority header present"), http.StatusBadRequest, !frame.StreamEnded()) + return nil + } if frame.StreamEnded() { // s is just created by the caller. No lock needed. s.state = streamReadDone diff --git a/vendor/google.golang.org/grpc/internal/xds/server/routing.go b/vendor/google.golang.org/grpc/internal/xds/server/routing.go index 67dd7609e1..706872585e 100644 --- a/vendor/google.golang.org/grpc/internal/xds/server/routing.go +++ b/vendor/google.golang.org/grpc/internal/xds/server/routing.go @@ -62,11 +62,14 @@ func RouteAndProcess(ctx context.Context) error { if !ok { return errors.New("missing metadata in incoming context") } - // A41 added logic to the core grpc implementation to guarantee that once - // the RPC gets to this point, there will be a single, unambiguous authority - // present in the header map. + // A41 added logic to the core grpc implementation to guarantee that once the + // RPC gets to this point, there will be a single, unambiguous authority + // present in the header map. But add a defensive check to ensure authority + // header is present. authority := md.Get(":authority") - // authority[0] is safe because of the guarantee mentioned above. + if len(authority) == 0 { + return rc.statusErrWithNodeID(codes.Internal, "no :authority header present") + } vh := findBestMatchingVirtualHostServer(authority[0], rc.vhs) if vh == nil { return rc.statusErrWithNodeID(codes.Unavailable, "the incoming RPC did not match a configured Virtual Host") diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go index 53c737feeb..a9dbafb876 100644 --- a/vendor/google.golang.org/grpc/version.go +++ b/vendor/google.golang.org/grpc/version.go @@ -19,4 +19,4 @@ package grpc // Version is the current grpc version. -const Version = "1.82.1" +const Version = "1.82.2" diff --git a/vendor/modules.txt b/vendor/modules.txt index 8c602c8131..89191acbea 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -2090,7 +2090,7 @@ google.golang.org/genproto/googleapis/api/monitoredres google.golang.org/genproto/googleapis/rpc/code google.golang.org/genproto/googleapis/rpc/errdetails google.golang.org/genproto/googleapis/rpc/status -# google.golang.org/grpc v1.82.1 +# google.golang.org/grpc v1.82.2 ## explicit; go 1.25.0 google.golang.org/grpc google.golang.org/grpc/attributes