fix(deps): update module google.golang.org/grpc to v1.56.3 [security] #43

renovate-sh-app · 2025-11-27T12:22:59Z

This PR contains the following updates:

Package	Change	Age	Confidence
google.golang.org/grpc	`v1.52.1` → `v1.56.3`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-m425-mq94-257g

Impact

In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit.

Patches

This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0.

Along with applying the patch, users should also ensure they are using the grpc.MaxConcurrentStreams server option to apply a limit to the server's resources used for any single connection.

Workarounds

None.

References

#6703

gRPC-Go HTTP/2 Rapid Reset vulnerability

BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 / BIT-contour-2023-44487 / BIT-dotnet-2023-44487 / BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487 / BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 / BIT-nginx-gateway-2023-44487 / BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 / BIT-node-min-2023-44487 / BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 / CGA-4mmr-qwxr-f88g / CGA-5jp5-95p2-jw83 / CGA-5v4r-558c-254r / CGA-9w4r-68hh-64j5 / CGA-m49h-wjp5-j434 / CGA-mp43-q6p3-96v2 / CVE-2023-44487 / GHSA-m425-mq94-257g / GHSA-qppj-fm5r-hxr3 / GO-2023-2153

More information

Details

Impact

In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit.

Patches

This vulnerability was addressed by #6703 and has been included in patch releases: 1.56.3, 1.57.1, 1.58.3. It is also included in the latest release, 1.59.0.

Along with applying the patch, users should also ensure they are using the grpc.MaxConcurrentStreams server option to apply a limit to the server's resources used for any single connection.

Workarounds

None.

References

#6703

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc

BIT-apisix-2023-44487 / BIT-aspnet-core-2023-44487 / BIT-contour-2023-44487 / BIT-dotnet-2023-44487 / BIT-dotnet-sdk-2023-44487 / BIT-envoy-2023-44487 / BIT-golang-2023-44487 / BIT-jenkins-2023-44487 / BIT-kong-2023-44487 / BIT-nginx-2023-44487 / BIT-nginx-gateway-2023-44487 / BIT-nginx-ingress-controller-2023-44487 / BIT-node-2023-44487 / BIT-node-min-2023-44487 / BIT-solr-2023-44487 / BIT-tomcat-2023-44487 / BIT-varnish-2023-44487 / CGA-4mmr-qwxr-f88g / CGA-5jp5-95p2-jw83 / CGA-5v4r-558c-254r / CGA-9w4r-68hh-64j5 / CGA-m49h-wjp5-j434 / CGA-mp43-q6p3-96v2 / CVE-2023-44487 / GHSA-m425-mq94-257g / GHSA-qppj-fm5r-hxr3 / GO-2023-2153

More information

Details

An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

grpc/grpc-go (google.golang.org/grpc)

`v1.56.3`: Release 1.56.3

Compare Source

Security

server: prohibit more than MaxConcurrentStreams handlers from running at once (CVE-2023-44487)

In addition to this change, applications should ensure they do not leave running tasks behind related to the RPC before returning from method handlers, or should enforce appropriate limits on any such work.

`v1.56.2`: Release 1.56.2

Compare Source

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

`v1.56.1`: Release 1.56.1

Compare Source

client: handle empty address lists correctly in addrConn.updateAddrs

`v1.56.0`: Release 1.56.0

Compare Source

New Features

client: support channel idleness using WithIdleTimeout dial option (#6263)
- This feature is currently disabled by default, but will be enabled with a 30 minute default in the future.
client: when using pickfirst, keep channel state in TRANSIENT_FAILURE until it becomes READY (gRFC A62) (#6306)
xds: Add support for Custom LB Policies (gRFC A52) (#6224)
xds: support pick_first Custom LB policy (gRFC A62) (#6314) (#6317)
client: add support for pickfirst address shuffling (gRFC A62) (#6311)
xds: Add support for String Matcher Header Matcher in RDS (#6313)
xds/outlierdetection: Add Channelz Logger to Outlier Detection LB (#6145)
- Special Thanks: @s-matyukevich
xds: enable RLS in xDS by default (#6343)
orca: add support for application_utilization field and missing range checks on several metrics setters
balancer/weightedroundrobin: add new LB policy for balancing between backends based on their load reports (gRFC A58) (#6241)
authz: add conversion of json to RBAC Audit Logging config (#6192)
authz: add support for stdout logger (#6230 and #6298)
authz: support customizable audit functionality for authorization policy (#6192 #6230 #6298 #6158 #6304 and #6225)

Bug Fixes

orca: fix a race at startup of out-of-band metric subscriptions that would cause the report interval to request 0 (#6245)
xds/xdsresource: Fix Outlier Detection Config Handling and correctly set xDS Defaults (#6361)
xds/outlierdetection: Fix Outlier Detection Config Handling by setting defaults in ParseConfig() (#6361)

API Changes

orca: allow a ServerMetricsProvider to be passed to the ORCA service and ServerOption (#6223)

`v1.55.1`: Release 1.55.1

Compare Source

status: To fix a panic, status.FromError now returns an error with codes.Unknown when the error implements the GRPCStatus() method, and calling GRPCStatus() returns nil. (#6374)

`v1.55.0`: Release 1.55.0

Compare Source

Behavior Changes

xds: enable federation support by default (#6151)
status: status.Code and status.FromError handle wrapped errors (#6031 and #6150)
- Special Thanks: @psyhatter

New Features

xds/xdsclient: support ignore_resource_deletion server feature as per gRFC A53 (#6035)
security/advancedtls: add min/max TLS version selection options (#6007)
- Special Thanks: @joeljeske

Bug Fixes

xds: stop routing RPCs to deleted clusters (#6125)
client: fix race between stream creation and GOAWAY receipt, which could lead to spurious UNAVAILABLE stream errors (#6142)

Performance Improvements

server: improve stream handler goroutine worker allocation when NumStreamWorkers is used (#6004)
- Special Thanks: @SaveTheRbtz

`v1.54.1`: Release 1.54.1

Compare Source

Bug Fixes

credentials/alts: revert a change that causes a crash in the handshaker

`v1.54.0`: Release 1.54.0

Compare Source

Behavior Changes

xds: remove support for xDS v2 transport API (#6013)

New Features

server: expose SetSendCompressor API to set send compressor name (#5744)
- Special Thanks: @jronak
xdsclient: include Node proto only in the first discovery request message, to improve performance (#6078)

Bug Fixes

metadata: fix validation logic and properly validate metadata appended via AppendToOutgoingContext (#6001)
- Special Thanks: @ktalg
transport: do not close connections when we encounter I/O errors until after all data is consumed (#6110)
ringhash: ensure addresses are consistently hashed across updates (#6066)
xds/clusterimpl: fix a bug causing unnecessary closing and re-opening of LRS streams (#6112)
xds: NACK route configuration if sum of weights of weighted clusters exceeds uint32_max (#6085)

Documentation

resolver: update Resolver.Scheme() docstring to mention requirement of lowercase scheme names (#6014)
resolver: document expected error handling of UpdateState errors (#6002)
- Special Thanks: @fho
examples: add example for ORCA load reporting (#6114)
examples: add an example to illustrate authorization (authz) support (#5920)
- Special Thanks: @KenxinKun

`v1.53.0`: Release 1.53.0

Compare Source

API Changes

balancer: support injection of per-call metadata from LB policies (#5853)
resolver: remove deprecated field resolver.Target.Endpoint and replace with resolver.Target.Endpoint() (#5852)
- Special Thanks: @kylejb

New Features

xds/ringhash: introduce GRPC_RING_HASH_CAP environment variable to override the maximum ring size. (#5884)
rls: propagate headers received in RLS response to backends (#5883)

Bug Fixes

transport: drain client transport when streamID approaches MaxStreamID (#5889)
server: after GracefulStop, ensure connections are closed when final RPC completes (#5968)
server: fix a few issues where grpc server uses RST_STREAM for non-HTTP/2 errors (#5893)
xdsclient: fix race which can happen when multiple load reporting calls are made at the same time. (#5927)
rls: fix a data race involving the LRU cache (#5925)
xds: fix panic involving double close of channel in xDS transport (#5959)
gcp/observability: update method name validation (#5951)

Documentation

credentials/oauth: mark NewOauthAccess as deprecated (#5882)
- Special Thanks: @buzzsurfr

`v1.52.3`: Release 1.52.3

Compare Source

Bug Fixes

Fix user-agent version

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

| datasource | package | from | to | | ---------- | ---------------------- | ------- | ------- | | go | google.golang.org/grpc | v1.52.1 | v1.56.3 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

github-actions · 2025-11-27T12:23:53Z

😢 zizmor failed with exit code 14.

Expand for full output

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/buf-lint.yml:13:9
   |
13 |       - uses: bufbuild/[email protected]
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/buf-lint.yml:16:9
   |
16 |       - uses: bufbuild/buf-lint-action@v1
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/buf-lint.yml:19:9
   |
19 |       - uses: bufbuild/buf-breaking-action@v1
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/buf.yml:12:9
   |
12 |       - uses: bufbuild/[email protected]
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/buf.yml:15:9
   |
15 |       - uses: bufbuild/buf-lint-action@v1
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/buf.yml:18:9
   |
18 |       - uses: bufbuild/buf-breaking-action@v1
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/buf.yml:22:9
   |
22 |       - uses: bufbuild/buf-push-action@v1
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/ci.yml:208:66
    |
208 |         run: ./scripts/ui_release.sh --check-package "$(echo ${{ github.ref_name }}|sed s/v2/v0/)"
    |         --- this run block                                       ^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/ci.yml:16:9
   |
16 |       - uses: prometheus/[email protected]
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/ci.yml:38:9
   |
38 |       - uses: prometheus/[email protected]
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/ci.yml:107:9
    |
107 |       - uses: prometheus/[email protected]
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/ci.yml:130:9
    |
130 |       - uses: prometheus/[email protected]
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/ci.yml:149:9
    |
149 |         uses: golangci/[email protected]
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/ci.yml:165:9
    |
165 |       - uses: prometheus/[email protected]
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/ci.yml:179:9
    |
179 |       - uses: prometheus/[email protected]
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/ci.yml:194:9
    |
194 |       - uses: prometheus/[email protected]
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/codeql-analysis.yml:29:9
   |
29 |         uses: github/codeql-action/init@v2
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/codeql-analysis.yml:34:9
   |
34 |         uses: github/codeql-action/autobuild@v2
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/codeql-analysis.yml:37:9
   |
37 |         uses: github/codeql-action/analyze@v2
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/fuzzing.yml:10:9
   |
10 |         uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/fuzzing.yml:15:9
   |
15 |         uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./.github/workflows/lock.yml:18:9
   |
18 |       - uses: dessant/lock-threads@v4
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-images]: unpinned image references
  --> ./.github/workflows/repo_sync.yml:10:7
   |
10 |       image: quay.io/prometheus/golang-builder
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ container image is unpinned
   |
   = note: audit confidence → High

83 findings (37 ignored, 23 suppressed, 1 fixable): 0 informational, 0 low, 0 medium, 23 high

renovate-sh-app bot added automerge-security-update severity:UNKNOWN labels Nov 27, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update module google.golang.org/grpc to v1.56.3 [security] #43

fix(deps): update module google.golang.org/grpc to v1.56.3 [security] #43

Uh oh!

renovate-sh-app bot commented Nov 27, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

fix(deps): update module google.golang.org/grpc to v1.56.3 [security] #43

Are you sure you want to change the base?

fix(deps): update module google.golang.org/grpc to v1.56.3 [security] #43

Uh oh!

Conversation

renovate-sh-app bot commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

GHSA-m425-mq94-257g

Impact

Patches

Workarounds

References

gRPC-Go HTTP/2 Rapid Reset vulnerability

Details

Impact

Patches

Workarounds

References

Severity

References

Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc

Details

Severity

References

Release Notes

v1.56.3: Release 1.56.3

Security

v1.56.2: Release 1.56.2

v1.56.1: Release 1.56.1

v1.56.0: Release 1.56.0

New Features

Bug Fixes

API Changes

v1.55.1: Release 1.55.1

v1.55.0: Release 1.55.0

Behavior Changes

New Features

Bug Fixes

Performance Improvements

v1.54.1: Release 1.54.1

Bug Fixes

v1.54.0: Release 1.54.0

Behavior Changes

New Features

Bug Fixes

Documentation

v1.53.0: Release 1.53.0

API Changes

New Features

Bug Fixes

Documentation

v1.52.3: Release 1.52.3

Bug Fixes

Configuration

Need help?

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate-sh-app bot commented Nov 27, 2025 •

edited

Loading

`v1.56.3`: Release 1.56.3

`v1.56.2`: Release 1.56.2

`v1.56.1`: Release 1.56.1

`v1.56.0`: Release 1.56.0

`v1.55.1`: Release 1.55.1

`v1.55.0`: Release 1.55.0

`v1.54.1`: Release 1.54.1

`v1.54.0`: Release 1.54.0

`v1.53.0`: Release 1.53.0

`v1.52.3`: Release 1.52.3