Skip to content

fix(deps): vuln minor upgrades — 4 packages (minor: 4) [local_tests/golang/go.mod] - #1408

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/golang/3-1791203013
Draft

fix(deps): vuln minor upgrades — 4 packages (minor: 4) [local_tests/golang/go.mod]#1408
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/golang/3-1791203013

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Summary: High-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

  • local_tests/golang/go.mod (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
google.golang.org/grpc v1.80.0 v1.83.2 minor Transitive 8 HIGH, 3 MEDIUM
github.com/valyala/fasthttp v1.41.0 v1.74.0 minor Transitive 1 UNKNOWN
golang.org/x/mod v0.36.0 v0.41.0 minor Transitive 2 UNKNOWN
golang.org/x/text v0.38.0 v0.42.0 minor Transitive 1 UNKNOWN

Security Details

🚨 Critical & High Severity (8 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
google.golang.org/grpc GHSA-2v4p-qf9q-27wj HIGH gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers v1.80.0 1.82.2 -
google.golang.org/grpc GO-2026-6061 HIGH Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc v1.80.0 1.82.1 -
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities v1.80.0 1.82.1 -
google.golang.org/grpc CVE-2026-84445 HIGH gRPC-Go: Denial of Service (DoS) via crash due to missing :authority and Host headers in the xDS servers v1.80.0 - -
google.golang.org/grpc GO-2026-6443 HIGH Server panic via missing authority or Host headers in google.golang.org/grpc v1.80.0 1.82.2 -
google.golang.org/grpc GO-2026-6348 high Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc v1.80.0 1.83.1 -
google.golang.org/grpc CVE-2026-84304 high gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation v1.80.0 - -
google.golang.org/grpc GHSA-vp52-pcj8-j9qc HIGH gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation v1.80.0 1.83.1 -
ℹ️ Other Vulnerabilities (7)
Package CVE Severity Summary Unsafe Version Fixed In Case
google.golang.org/grpc GO-2026-6441 medium Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc v1.80.0 1.83.1 -
google.golang.org/grpc CVE-2026-84303 medium gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion v1.80.0 - -
google.golang.org/grpc GHSA-qc2q-p7wx-3px3 MODERATE gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion v1.80.0 1.83.1 -
github.com/valyala/fasthttp GO-2026-4950 unknown Authorization bypass via double-encoded paths in github.com/valyala/fasthttp v1.41.0 1.70.0 -
golang.org/x/mod GO-2026-6180 unknown Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb v0.36.0 0.40.0 -
golang.org/x/mod GO-2026-6179 unknown Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog v0.36.0 0.40.0 -
golang.org/x/text GO-2026-5970 unknown Infinite loop on invalid input in golang.org/x/text v0.38.0 0.39.0 -
⚠️ Dependencies that have Reached EOL (1)
Dependency Unsafe Version EOL Date New Version Path Case
github.com/valyala/fasthttp v1.41.0 Oct 25, 2025 v1.74.0 local_tests/golang/go.mod -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@datadog-prod-us1-5

datadog-prod-us1-5 Bot commented Oct 5, 2026 •
edited by datadog-official Bot
Loading

Copy link
Copy Markdown

Pipelines

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

DataDog/datadog-lambda-extension | bottlecap (arm64, alpine)

View more details · View in GitLab

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4e3802f | Docs | View more details | Give us feedback!

@gh-worker-campaigns-3e9aa4

gh-worker-campaigns-3e9aa4 Bot commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Auto-rebase complete

Branch is up to date with main — rebased onto 4aa6ae8.

Auto-Rebase · Add no-auto-rebase to opt out

@dd-octo-sts-6bb5b9
dd-octo-sts-6bb5b9 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/golang/3-1791203013 branch from a58d08b to 5397e92 Compare October 9, 2026 16:01
@dd-octo-sts-0c48d7 @dd-octo-sts-6bb5b9
ADMS: vuln minor upgrades — 4 packages (minor: 4) [local_tests/golang…
4e3802f 
…/go.mod]

Co-authored-by: dd-octo-sts-6bb5b9[bot] <256648796+dd-octo-sts-6bb5b9[bot]@users.noreply.github.com>
@dd-octo-sts-0c48d7
dd-octo-sts-0c48d7 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/golang/3-1791203013 branch from 5397e92 to 4e3802f Compare October 13, 2026 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot will automatically review once the pull request is marked ready for review

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

adms-dependency-update adms-fixes-eol adms-go adms-high-severity adms-medium-severity adms-minor-update adms-mode-all-vulns bot_family:adms-dependency-update campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants