-
Notifications
You must be signed in to change notification settings - Fork 2
chore(deps): bump the security-updates group across 1 directory with 20 updates #161
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
dependabot
wants to merge
1
commit into
main
Choose a base branch
from
dependabot/go_modules/main/security-updates-34829a80e9
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: kubeservice-stack/common
Length of output: 212
🌐 Web query:
GHSA auth bypass google.golang.org/grpc v1.63.2💡 Result:
The security vulnerability you are inquiring about is identified as CVE-2026-33186 (also tracked as GHSA-p77j-4mvh-x3m3) [1][2]. It is an authorization bypass vulnerability in the gRPC-Go library (google.golang.org/grpc) that allows an attacker to potentially circumvent path-based authorization policies [3][4][5]. The issue arises because, in versions prior to 1.79.3, the gRPC-Go server was overly permissive when processing the HTTP/2:path pseudo-header [3][6]. According to RFC 7540, this header must begin with a leading slash (e.g., /Service/Method) [6]. However, previous versions of the library accepted requests where this leading slash was omitted (e.g., Service/Method) [3][7]. While the server correctly routed these malformed requests to the appropriate handler, the raw, non-canonical path string was passed to authorization interceptors (such as the official grpc/authz package) [3][8][1]. Consequently, if a server's security policy relied on "deny" rules based on canonical paths (starting with /) but contained a fallback "allow" rule, the policy would fail to match the incoming non-canonical path, resulting in an authorization bypass [3][4][5]. This vulnerability is patched in google.golang.org/grpc version 1.79.3 [3][1][5]. The fix ensures that any request with a:path header lacking a leading slash is immediately rejected with a codes.Unimplemented error, preventing the request from reaching authorization interceptors [3][4][1]. Note: The version 1.63.2 referenced in your query is an affected version, as it is earlier than 1.79.3 [1][2]. Users are strongly advised to upgrade to 1.79.3 or newer [3][1][5]. If an immediate upgrade is not possible, mitigations include implementing a validating interceptor to reject malformed paths, ensuring infrastructure-level normalization of HTTP/2 headers, or hardening authorization policies to default-deny [4][8][5].
Citations:
🌐 Web query:
google.golang.org/grpc 1.63.2 security advisory💡 Result:
There is no security advisory specifically targeting version 1.63.2 of the google.golang.org/grpc library [1][2]. Version 1.63.2 was released in April 2024 to address minor bug fixes, such as correcting user agent strings and un-deprecating certain API methods [2]. The security-related information you may have encountered is likely conflated with a more recent vulnerability, CVE-2026-33186 (GHSA-p77j-4mvh-x3m3), which affects gRPC-Go versions prior to 1.79.3 [3][4][5]. This vulnerability involves an authorization bypass caused by improper input validation of the HTTP/2:path pseudo-header [3][5]. It specifically impacts servers that use path-based authorization interceptors and have specific "deny" rules for canonical paths [4][5][6]. Users of earlier versions, including 1.63.2, are advised to upgrade to version 1.79.3 or newer to mitigate this issue [3][4][5].
Citations:
🏁 Script executed:
Repository: kubeservice-stack/common
Length of output: 476
Critical security fix:
grpcis still pinned to vulnerablev1.63.2viareplacego.modrequiresgoogle.golang.org/grpc v1.81.1(line 38), butreplace google.golang.org/grpc => google.golang.org/grpc v1.63.2(line 170) overrides it—so the resolved dependency remainsv1.63.2. That version is affected by GHSA-p77j-4mvh-x3m3 / CVE-2026-33186 (patched ingrpc v1.79.3).Suggested fix
🧰 Tools
🪛 OSV Scanner (2.3.8)
[CRITICAL] 38-38: google.golang.org/grpc 1.63.2: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
(GO-2026-4762)
[CRITICAL] 38-38: google.golang.org/grpc 1.63.2: gRPC-Go has an authorization bypass via missing leading slash in :path
(GHSA-p77j-4mvh-x3m3)
🤖 Prompt for AI Agents
Source: Linters/SAST tools