GO-2026-4762Published

gRPC-Go has an authorization bypass via missing leading slash in :path

Related advisories and sources

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-33186 · CVE overview and exploitation status

EUVD-2026-13830

GHSA-p77j-4mvh-x3m3

GO-2026-4762

cve-program · CVE-2026-33186

https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3

euvd · EUVD-2026-13830

https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3

nvd · CVE-2026-33186

osv · GHSA-p77j-4mvh-x3m3

osv · GO-2026-4762

https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3

Related changes

Linked by CVE identifier

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, … · Advisory content revised · 15 Nov 2026
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, … · Advisory content revised · 5 Nov 2026
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, … · Advisory content revised · 1 Nov 2026
Release 2026-04-02 · Tool release · 9 Apr 2026