Skip to content

[Aikido] Fix security issue in google.golang.org/grpc via minor version upgrade from 1.80.0 to 1.82.1 - #1099

Closed
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-72190921-nkro
Closed

[Aikido] Fix security issue in google.golang.org/grpc via minor version upgrade from 1.80.0 to 1.82.1#1099
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/aikido-security-update-packages-72190921-nkro

Conversation

@aikido-autofix

Copy link
Copy Markdown
Contributor

Upgrade grpc-go to fix authorization bypass in xDS RBAC, HTTP/2 Rapid Reset DoS, and server panic vulnerabilities.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
GHSA-hrxh-6v49-42gf
HIGH
[google.golang.org/grpc] Three vulnerabilities affect xDS RBAC authorization and HTTP/2 transport: authorization bypass when unsupported Metadata/RequestedServerName matchers are silently ignored, denial of service via HTTP/2 Rapid Reset mitigation bypass causing high CPU, and server panic when NOT rules wrap unsupported fields in RBAC policies.

@aikido-autofix aikido-autofix Bot added the aikido Label created by Aikido AutoFix label Jul 23, 2026
@deepsource-io

deepsource-io Bot commented Jul 23, 2026

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 43d7321...27b3891 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
Go Jul 23, 2026 12:46a.m. Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@codecov

codecov Bot commented Jul 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@aikido-autofix

Copy link
Copy Markdown
Contributor Author

Closed by Aikido: a new AutoFix has been created → #1101

@aikido-autofix aikido-autofix Bot closed this Jul 25, 2026
@aikido-autofix
aikido-autofix Bot deleted the fix/aikido-security-update-packages-72190921-nkro branch July 25, 2026 00:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aikido Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant