Skip to content

[Aikido] Fix security issue in google.golang.org/grpc via minor version upgrade from 1.83.1 to 1.83.2 - #1112

Merged
shenzhaoyan merged 1 commit into
mainfrom
fix/aikido-security-update-packages-109423237-jzo7
Sep 9, 2026
Merged

shenzhaoyan merged 1 commit into
mainfrom
fix/aikido-security-update-packages-109423237-jzo7

Conversation

@aikido-autofix

@aikido-autofix aikido-autofix Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Upgrade gRPC-Go to fix DoS vulnerability in xDS servers where missing :authority and Host headers cause server panic and complete outage.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-84445
HIGH
[google.golang.org/grpc] xDS-configured gRPC servers panic when receiving requests without :authority or Host headers, causing server crash and denial of service. The vulnerability affects servers with insecure/standard TLS; mTLS/ALTS deployments require valid transport credentials to exploit.

@aikido-autofix aikido-autofix Bot added the aikido Label created by Aikido AutoFix label Sep 9, 2026
@deepsource-io

deepsource-io Bot commented Sep 9, 2026 •

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 9a65991...9882e66 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
Go Sep 9, 2026 1:06a.m. Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@codecov

codecov Bot commented Sep 9, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@shenzhaoyan
shenzhaoyan merged commit 81ea567 into main Sep 9, 2026
10 checks passed
@shenzhaoyan
shenzhaoyan deleted the fix/aikido-security-update-packages-109423237-jzo7 branch September 9, 2026 05:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aikido Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant