Upgrade google.golang.org/grpc v1.69.4 to google.golang.org/grpc v1.79.3

[Aneeshaukrani]

Terraform Version

Terraform v1.13.4

Use Cases

I am not on latest version of terraform, but even the latest version does not have google.golang.org/grpc upgraded to 1.79.3. Can you please upgrade this package as the following CVE has been reported for this 1.69.4 version -- CVE-2026-33186 - https://nvd.nist.gov/vuln/detail/CVE-2026-33186

It is being flagged as a Security Vulnerability in our scans due to this CVE.

Attempted Solutions

I am not on latest version of terraform, but even the latest version does not have google.golang.org/grpc upgraded to 1.79.3.

Proposal

Please upgrade this package google.golang.org/grpc to 1.79.3 version

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33186

[crw]

Thanks for this report. I have not looking into this CVE in detail, but if it is not actually exercised by the Terraform codebase, then the package will be updated as per normal updating cycles. In other words, it may be the case that so long as this is not a CVE for Terraform, you should adjust your code scanning tools accordingly rather than wait for an update. Thanks for the submission.

[apparentlymart]

FWIW I already reviewed this advisory for another similar codebase and noted that it only affects gRPC servers, and furthermore it only affects gRPC servers that use authorization interceptors.

I believe most of Terraform's usage of gRPC is as a client (for interacting with plugins) and so those interactions are out of scope for that advisory.

The server side of a go-plugin interaction does use the gRPC server functionality, but does not use authorization interceptors because the plugin system uses mutual TLS authentication rather than gRPC authentication.

Therefore I don't think this advisory is relevant to Terraform, but I'm saying that based only on a high-level mental model of how I believe Terraform behaves and not analysis of the Terraform source code.

[crw]

Please see #38292 (comment)