Loading story…
A high-severity flaw tracked as CVE-2026-33186 allows attackers to bypass path-based authorization in gRPC-Go by sending malformed HTTP/2 requests whose :path pseudo-header omits the required leading slash. In affected versions before 1.79.3, the server still routed requests correctly, but authorization components evaluated the non-canonical path value, creating a mismatch that let canonical deny rules fail. The issue affects deployments using google.golang.org/grpc/authz RBAC as well as custom interceptors that rely on info.FullMethod or grpc.Method(ctx) while otherwise permitting requests by default.
Reports say the flaw can also impact products and middleware built on gRPC-Go, including Traefik custom middleware, where policies written for paths such as /InternalService/SensitiveMethod could be bypassed with malformed variants like InternalService/SensitiveMethod. Exploitation requires the ability to send raw HTTP/2 frames directly to a gRPC server. The fix in gRPC-Go 1.79.3 rejects any request whose :path does not begin with / and returns a codes.Unimplemented error; recommended mitigations also include adding request-validation interceptors, normalizing requests upstream, and tightening authorization policies.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A later advisory reported that the same gRPC-Go path canonicalization flaw could enable deny-rule bypass in Traefik deployments using custom middleware or grpc/authz-based authorization. It clarified that canonical policy paths such as /InternalService/SensitiveMethod would not match malformed requests lacking the leading slash.
Version 1.79.3 was released to fix CVE-2026-33186 by rejecting any request whose HTTP/2 :path pseudo-header does not begin with a slash, returning a codes.Unimplemented error. Recommended mitigations also included upgrading, adding validation interceptors, normalizing requests upstream, and tightening authorization policies.
In gRPC-Go versions prior to 1.79.3, malformed HTTP/2 :path values without a leading slash could still be routed while being passed non-canonically to authorization logic. This allowed path-based deny rules in grpc/authz or custom interceptors to be bypassed in affected deployments.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Maintainers disclosed two high-severity HTTP/2 denial-of-service flaws that can be triggered by malicious protocol frames in widely used implementations. In **nghttp2**, `CVE-2026-27135` causes an assertion failure after session termination has begun if the library continues processing incoming data and encounters a malformed frame that leads to `FRAME_SIZE_ERROR`. The vulnerable paths include `ALTSVC`, `PRIORITY_UPDATE`, and user-defined extension frames, with the issue fixed in **nghttp2 v1.68.1** by adding missing internal state validation; no workaround was provided. In Go's HTTP/2 transport, `CVE-2026-33814` allows a malicious server to force an infinite loop of `CONTINUATION` frame writes by sending a `SETTINGS` frame with `SETTINGS_MAX_FRAME_SIZE=0`, creating a remote denial-of-service condition against HTTP/2 clients. The flaw, tracked as Go issue `#78476` and later documented by Microsoft with a **CVSS 7.5** rating, was fixed by validating received `SETTINGS_MAX_FRAME_SIZE` values before use, underscoring continued risk from improper state and bounds checking in HTTP/2 frame handling.
Aug 25, 2026
Go fixed **CVE-2022-27664**, a denial-of-service vulnerability in the HTTP/2 server implementation used by `net/http`. A remote client could cause a server connection to hang indefinitely when a fatal error interrupted clean shutdown after the server had sent a `GOAWAY` frame, potentially exhausting server resources through repeated connections. The fix updated the bundled `golang.org/x/net/http2` code and was backported to supported Go 1.18 and 1.19 release branches, including the Go 1.18.6 and 1.19.1 security releases. Go 1.17 did not receive a backport under the project’s release policy; organizations operating affected or unsupported Go versions should upgrade to a supported patched release and assess internet-facing HTTP/2 services for exposure.
Aug 27, 2026
CERT/CC disclosed eight HTTP/2 denial-of-service weaknesses involving abnormal traffic and resource exhaustion. gRPC implementations were affected by `CVE-2019-9512` (Ping Flood), `CVE-2019-9514` (Reset Flood), and `CVE-2019-9515` (Settings Flood), which allow malicious peers to send excessive HTTP/2 frames and drive unbounded memory consumption or otherwise exhaust service resources. Fixes were released for gRPC-Go and gRPC-Java, while remediation for gRPC-C and languages wrapping it was underway; users were urged to upgrade promptly. Istio released version 1.2.4, and Red Hat patched the affected gRPC component in the `sriov-network-device-plugin` container through OpenShift Container Platform 4.1.18; OpenShift 4.1 operators should upgrade clusters to receive the fixes.
Aug 29, 2026