Skip to content

[Aikido] Fix security issue in google.golang.org/grpc via minor version upgrade from 1.82.1 to 1.83.1 - #118

Closed
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-MAINT-1594-update-packages-104495568-ir2m
Closed

aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-MAINT-1594-update-packages-104495568-ir2m

Conversation

@aikido-autofix

@aikido-autofix aikido-autofix Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Upgrade gRPC-Go to fix memory exhaustion DoS vulnerability allowing remote attackers to crash services via fragmented HTTP/2 frames.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-84304
MEDIUM
[google.golang.org/grpc] A remote attacker can send millions of fragmented one-byte HTTP/2 DATA frames across multiplexed streams to exhaust heap memory and cause denial of service through runtime panic or out-of-memory termination. The vulnerability bypasses flow-control protections by storing each frame separately in the receive buffer.
🔗 Related Tasks

@aikido-autofix aikido-autofix Bot added the aikido Label created by Aikido AutoFix label Sep 3, 2026
@theplant-ci

Copy link
Copy Markdown

Hi @aikido-autofix[bot]. Thanks for your PR.

PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test all.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@aikido-autofix aikido-autofix Bot closed this Sep 5, 2026
@aikido-autofix

aikido-autofix Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Closed by Aikido: the vulnerability is already resolved.

@aikido-autofix
aikido-autofix Bot deleted the fix/aikido-security-MAINT-1594-update-packages-104495568-ir2m branch September 5, 2026 01:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aikido Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant