chore(deps): update module google.golang.org/grpc to v1.83.1 [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
google.golang.org/grpc	indirect	minor	v1.82.1 -> v1.83.1

---

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

CVE-2026-84304 / GHSA-vp52-pcj8-j9qc

More information

Details

Impact

An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.

Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).

Patches

The change to fix this issue is merged in master and a patch release, 1.83.1, has been published that contains this fix.

Workarounds

This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.

This behavior is enabled by default. A temporary escape hatch is provided via the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false to disable the feature if unforeseen issues arise, but it will be removed in a future release.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc
• https://nvd.nist.gov/vuln/detail/CVE-2026-84304
• https://github.com/grpc/grpc-go/pull/9331
• https://github.com/grpc/grpc-go/pull/9333
• https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176
• https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.83.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

grpc/grpc-go (google.golang.org/grpc)

v1.83.1: Release 1.83.1

Compare Source

Security

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#​9332)
  • Special Thanks: @​alimony

Performance

• transport: Restrict memory overhead of buffering small data frames. (#​9331)

v1.83.0: Release 1.83.0

Compare Source

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#​9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#​9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#​9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#​9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#​9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#​9151)
• xds: Add support for contains_match in route header matchers. (#​9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#​9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#​9255)
  • Special Thanks: @​Yusufihsangorgel

v1.82.2: Release 1.82.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (https://github.com/grpc/grpc-go/pull/9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

ℹ Artifact update notice

File name: deployment/operator/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.44.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260519071638-aa98bba5eb94 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260519071638-aa98bba5eb94 -> v0.0.0-20260526163538-3dc84a4a5aaa

File name: tools/utils/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.44.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260414002931-afd174a4e478 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260414002931-afd174a4e478 -> v0.0.0-20260526163538-3dc84a4a5aaa

[NumaryBot]

✅ Approve — automated review

The dependency updates are consistent across both affected Go modules and their checksum files. No actionable regression is evident in the diff.

No findings.

[shipfox-ai]

Review: PR #533 — update google.golang.org/grpc to v1.83.1 [security]

This is a Renovate-generated, dependency-only bump touching deployment/operator/{go.mod,go.sum} and tools/utils/{go.mod,go.sum}. It advances the indirect dependency google.golang.org/grpc to v1.83.1 (security fix) plus the transitively pulled google.golang.org/genproto/googleapis/{api,rpc} and go.opentelemetry.io/otel/sdk to v1.44.0. I independently verified the module/checksum consistency, the absence of stale entries, that grpc is used only as an indirect dependency, and that no other module in the repo pins grpc. The change is sound. Recommendation: approve.

Confirmed findings

No material finding was confirmed. Verification performed against the working tree:

• Versions consistent across both affected modules. deployment/operator/go.mod:117 and tools/utils/go.mod:83 both pin google.golang.org/grpc v1.83.1; otel/sdk v1.44.0 at deployment/operator/go.mod:101 and tools/utils/go.mod:69; genproto api/rpc @ v0.0.0-20260526163538-3dc84a4a5aaa at deployment/operator/go.mod:115-116 and tools/utils/go.mod:81-82.
• go.sum complete and clean. Both deployment/operator/go.sum and tools/utils/go.sum contain the h1: and /go.mod hash lines for grpc v1.83.1, otel/sdk v1.44.0, and both genproto pseudo-versions; grep for grpc v1.82.1 / otel/sdk v1.43.0 returned nothing (no stale entries).
• grpc is indirect-only. grep -rn "google.golang.org/grpc" --include="*.go" returns zero matches across the repo (including tests), so no API surface is affected and the minor bump carries no breaking-change risk here.
• No un-updated modules. Only these two modules declare a grpc dependency; the root go.mod and tools/kubectl-stacks/go.mod do not reference grpc, so nothing was left behind by the bump.
• Go-version compatibility. Declared go 1.26.2 (deployment/operator) and go 1.25.0 (tools/utils) both satisfy the requirements of grpc v1.83.1 and otel/sdk v1.44.0.

Note: the otlptracegrpc version skew between the two modules (v1.43.0 vs v1.41.0) is pre-existing and unrelated to this PR; not a finding. As I could not run the Go toolchain in this environment, the final go build / go mod verify gate should be confirmed by CI.

Reviewed by Claude (claude-opus-4.8) and Codex (gpt-5.6-sol) via Shipfox; verified and synthesized by Claude.