Spotted what might be an issue in go.mod around line 1.
This CRITICAL vulnerability stems from gRPC-Go versions <1.79.3 improperly validating the HTTP/2 :path pseudo-header. The server accepts malformed requests missing the mandatory leading slash, which causes path-based authorization interceptors to evaluate non-canonical strings against security policies. Attackers can exploit this by crafting raw HTTP/2 frames with stripped slashes to bypass explicit 'deny' rules and trigger fallback 'allow' policies, resulting in unauthorized access to restricted RPC endpoints. Immediate patching is required to restore policy enforcement and prevent authentication/authorization bypass.
Something like this might fix it:
--- a/go.mod
+++ b/go.mod
@@ -1 +1 @@
-require google.golang.org/grpc v1.65.0
+require google.golang.org/grpc v1.79.3
# Apply the fix using:
# go get google.golang.org/grpc@v1.79.3
# go mod tidy
For reference: rule CVE-2026-33186. Rated critical.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
go.modaround line 1.This CRITICAL vulnerability stems from gRPC-Go versions <1.79.3 improperly validating the HTTP/2
:pathpseudo-header. The server accepts malformed requests missing the mandatory leading slash, which causes path-based authorization interceptors to evaluate non-canonical strings against security policies. Attackers can exploit this by crafting raw HTTP/2 frames with stripped slashes to bypass explicit 'deny' rules and trigger fallback 'allow' policies, resulting in unauthorized access to restricted RPC endpoints. Immediate patching is required to restore policy enforcement and prevent authentication/authorization bypass.Something like this might fix it:
For reference: rule
CVE-2026-33186. Rated critical.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.