CVE-2026-84445Disclosure

Two Kubernetes feature gates are gone: MultiCIDRServiceAllocator and DisableAllocatorDualWrite have been removed. gRPC gets bumped to v1.82.2 in pod-security-admission, and the branch it came in on references grpc-cve-2026-84445. Elsewhere: a fix marks invalid all-device allocation as a per-node failure in dynamic-resource-allocation. ktesting got its implementation code reorganized (doc․go, tcontext․go, assert․go, signal*.go) to make the source readable top-to-bottom. #kubernetes https://repojournal.com/showcase/kubernetes/2026-09-12/service-cidr-feature-gates-retired-grpc-bumped-to-1-82-2

Kubernetes is bumping google․golang․org/grpc to v1.82.2 across kubernetes/kubernetes and dynamic-resource-allocation, tagged against CVE-2026-84445. The dependency lands in both repos. If you track either, that's the change to pull. Elsewhere, kubeadm gets a bug fix: ServiceIsEnabled was matching on the whole rc-update show output instead of the service and runlevel columns, which broke OpenRC enablement detection. And in DRA, an invalid all-device allocation is now marked as a per-node failure. #kubernetes https://repojournal.com/showcase/kubernetes/2026-09-12/service-cidr-feature-gates-retired-grpc-bumped-to-1-82-2

CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-81870 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 N/A Security fixes for apigee-mart-server. This addresses the following vulnerabilities: CVE-2024-6763 CVE-2025-46392 CVE-2026-10050 7/16

🚨HIGH - gRPC-Go xDS Routing Panic DoS via Missing Host/:authority (CVE-2026-84445) In gRPC-Go servers using xds.NewGRPCServer(), an HTTP/2 request missing both :authority and Host triggers an index-out-of-bounds panic in the xDS routing interceptor; the per-RPC goroutine doesn’t recover, crashing the whole process (DoS). Non-xDS servers are not impacted. 👉Affected: http://google.golang.org/grpc (gRPC-Go) with xds.NewGRPCServer() enabled