CVE catalog

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST reque

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-grpc-ecosystem-grpc-gatewaysid2.30.0-1fixed
Debiangolang-github-grpc-ecosystem-grpc-gatewayforky2.30.0-1fixed
Debiangolang-github-grpc-ecosystem-grpc-gatewaytrixie2.20.0-2vulnerable
Debiangolang-github-grpc-ecosystem-grpc-gatewaybookworm1.6.4-2vulnerable
Susehelmlinux enterprise server 16.03.21.3-160000.2.1fixed
Susehelmlinux enterprise server for sap applications 16.03.21.3-160000.2.1fixed
Susedistributionlinux enterprise server 16.03.1.1-160000.3.1fixed
Susedistributionlinux enterprise server for sap applications 16.03.1.1-160000.3.1fixed
Susedistributionlinux enterprise server 16.03.1.1-160000.3.1fixed
Susedistributionlinux enterprise server for sap applications 16.03.1.1-160000.3.1fixed
Opensusedistributionleap 16.03.1.1-160000.3.1fixed
Opensuseamazon-cloudwatch-agenttumbleweed1.300072.0-1.1fixed
Susehelmlinux micro 6.13.21.3-slfo.1.1_2.1fixed
Susehelmlinux enterprise micro 5.53.21.3-150000.1.96.1fixed
Susehelmlinux enterprise module for containers 15 sp73.21.3-150000.1.96.1fixed
Susehelmlinux enterprise module for package hub 15 sp73.21.3-150000.1.96.1fixed
Susehelmlinux enterprise high performance computing 15 sp4-espos3.21.3-150000.1.96.1fixed
Susehelmlinux enterprise high performance computing 15 sp4-ltss3.21.3-150000.1.96.1fixed
Susehelmlinux enterprise high performance computing 15 sp5-espos3.21.3-150000.1.96.1fixed
Susehelmlinux enterprise high performance computing 15 sp5-ltss3.21.3-150000.1.96.1fixed
Susehelmlinux enterprise server 15 sp4-ltss3.21.3-150000.1.96.1fixed
Susehelmlinux enterprise server 15 sp5-ltss3.21.3-150000.1.96.1fixed
Susehelmlinux enterprise server 15 sp6-ltss3.21.3-150000.1.96.1fixed
Susehelmlinux enterprise server for sap applications 15 sp43.21.3-150000.1.96.1fixed
Susehelmlinux enterprise server for sap applications 15 sp53.21.3-150000.1.96.1fixed
Susehelmlinux enterprise server for sap applications 15 sp63.21.3-150000.1.96.1fixed
Susehelmlinux micro 6.23.21.3-160000.2.1fixed
Susec-areslinux micro 6.21.34.8-160000.1.1fixed
Susehelmlinux micro 6.03.21.3-2.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp41.300069.0-150400.9.10.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp51.300069.0-150400.9.10.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp61.300069.0-150400.9.10.1fixed
Suseamazon-cloudwatch-agentlinux enterprise module for public cloud 15 sp71.300069.0-150400.9.10.1fixed
Opensusehelmleap 16.03.21.3-160000.2.1fixed
Opensusehaulerleap 16.02.1.0-bp160.1.1fixed
Opensusehelmtumbleweed4.2.4-3.1fixed
Opensusedistributiontumbleweed3.1.1-6.1fixed
Opensusehelm3tumbleweed3.21.3-7.1fixed
Opensusehaulertumbleweed2.1.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-grpc-ecosystem-grpc-gatewaysourcesid2.30.0-1not yet assignedNot reportedNot reported
Debiangolang-github-grpc-ecosystem-grpc-gatewaysourceforky2.30.0-1not yet assignedNot reportedNot reported
Debiangolang-github-grpc-ecosystem-grpc-gatewaysourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-grpc-ecosystem-grpc-gatewaysourcebookworm(unfixed)not yet assignedNot reportedNot reported
Susehelmrpmlinux enterprise server 16.03.21.3-160000.2.1Not reportedSUSE-SU-2026:23688-1Not reported
Susehelmrpmlinux enterprise server for sap applications 16.03.21.3-160000.2.1Not reportedSUSE-SU-2026:23688-1Not reported
Susedistributionrpmlinux enterprise server 16.03.1.1-160000.3.1Not reportedSUSE-SU-2026:23864-1Not reported
Susedistributionrpmlinux enterprise server for sap applications 16.03.1.1-160000.3.1Not reportedSUSE-SU-2026:23864-1Not reported
Susedistributionrpmlinux enterprise server 16.03.1.1-160000.3.1Not reportedSUSE-SU-2026:23852-1Not reported
Susedistributionrpmlinux enterprise server for sap applications 16.03.1.1-160000.3.1Not reportedSUSE-SU-2026:23852-1Not reported
Opensusedistributionrpmleap 16.03.1.1-160000.3.1Not reportedOPENSUSE-SU-2026:21898-1Not reported
Opensuseamazon-cloudwatch-agentrpmtumbleweed1.300072.0-1.1Not reportedOPENSUSE-SU-2026:11828-1Not reported
Susehelmrpmlinux micro 6.13.21.3-slfo.1.1_2.1Not reportedSUSE-SU-2026:23522-1Not reported
Susehelmrpmlinux enterprise micro 5.53.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise module for containers 15 sp73.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise module for package hub 15 sp73.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp4-espos3.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp4-ltss3.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp5-espos3.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp5-ltss3.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise server 15 sp4-ltss3.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise server 15 sp5-ltss3.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise server 15 sp6-ltss3.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp43.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp53.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp63.21.3-150000.1.96.1Not reportedSUSE-SU-2026:4175-1Not reported
Susehelmrpmlinux micro 6.23.21.3-160000.2.1Not reportedSUSE-SU-2026:23506-1Not reported
Susec-aresrpmlinux micro 6.21.34.8-160000.1.1Not reportedSUSE-SU-2026:23456-1Not reported
Susehelmrpmlinux micro 6.03.21.3-2.1Not reportedSUSE-SU-2026:23456-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp41.300069.0-150400.9.10.1Not reportedSUSE-SU-2026:4045-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp51.300069.0-150400.9.10.1Not reportedSUSE-SU-2026:4045-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp61.300069.0-150400.9.10.1Not reportedSUSE-SU-2026:4045-1Not reported
Suseamazon-cloudwatch-agentrpmlinux enterprise module for public cloud 15 sp71.300069.0-150400.9.10.1Not reportedSUSE-SU-2026:4045-1Not reported
Opensusehelmrpmleap 16.03.21.3-160000.2.1Not reportedOPENSUSE-SU-2026:21809-1Not reported
Opensusehaulerrpmleap 16.02.1.0-bp160.1.1Not reportedOPENSUSE-SU-2026:21793-1Not reported
Opensusehelmrpmtumbleweed4.2.4-3.1Not reportedOPENSUSE-SU-2026:11718-1Not reported
Opensusedistributionrpmtumbleweed3.1.1-6.1Not reportedOPENSUSE-SU-2026:11697-1Not reported
Opensusehelm3rpmtumbleweed3.21.3-7.1Not reportedOPENSUSE-SU-2026:11669-1Not reported
Opensusehaulerrpmtumbleweed2.1.0-1.1Not reportedOPENSUSE-SU-2026:11667-1Not reported

Notes

[trixie] golang-github-grpc-ecosystem-grpc-gateway: Minor issue [bookworm] golang-github-grpc-ecosystem-grpc-gateway: Limited support

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-grpc-ecosystem-grpc-gateway-dev]Affected

    Source package: [golang-github-grpc-ecosystem-grpc-gateway]

    Details (2)

    • 1.6.4-2 · all · bookworm

      Affected

      nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · bookworm; nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · 12

    • 1.6.4-2 · all · bookworm

      Affected

      nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · bookworm; nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · 12

  • [golang-grpc-gateway]Affected

    Source package: [golang-github-grpc-ecosystem-grpc-gateway]

    Details (2)

    • 1.6.4-2+b23 · amd64 · bookworm

      Affected

      nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · bookworm; nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · 12

    • 1.6.4-2+b23 · arm64 · bookworm

      Affected

      nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · bookworm; nvd · golang-github-grpc-ecosystem-grpc-gateway · debian · 12

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

  • [amazon-cloudwatch-agent]Affected

    Source package: [amazon-cloudwatch-agent]

    Details (1)

    • 1.300071.0-2.1 · x86_64 · tumbleweed

      Affected · Fixed: 1.300072.0-1.1

      nvd · amazon-cloudwatch-agent · opensuse · tumbleweed

  • [hauler]Affected

    Source package: [hauler]

    Details (1)

    • 2.0.3-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 2.1.0-1.1

      nvd · hauler · opensuse · tumbleweed

  • [helm]Affected

    Source package: [helm]

    Details (1)

    • 4.2.4-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 4.2.4-3.1

      nvd · helm · opensuse · tumbleweed

  • [helm3]Affected

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · x86_64 · tumbleweed

      Affected · Fixed: 3.21.3-7.1

      nvd · helm3 · opensuse · tumbleweed

  • [distribution-registry]Unknown

    Source package: [distribution]

    Details (1)

    • 3.1.1-5.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.1-6.1

      Version impact unknown

      nvd · distribution · opensuse · tumbleweed

  • [helm3-bash-completion]Unknown

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · noarch · tumbleweed

      Unknown · Fixed: 3.21.3-7.1

      Version impact unknown

      nvd · helm3 · opensuse · tumbleweed

  • [helm3-fish-completion]Unknown

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · noarch · tumbleweed

      Unknown · Fixed: 3.21.3-7.1

      Version impact unknown

      nvd · helm3 · opensuse · tumbleweed

  • [helm3-zsh-completion]Unknown

    Source package: [helm3]

    Details (1)

    • 3.21.3-6.1 · noarch · tumbleweed

      Unknown · Fixed: 3.21.3-7.1

      Version impact unknown

      nvd · helm3 · opensuse · tumbleweed

  • [helm-bash-completion]Unknown

    Source package: [helm]

    Details (1)

    • 4.2.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 4.2.4-3.1

      Version impact unknown

      nvd · helm · opensuse · tumbleweed

  • [helm-fish-completion]Unknown

    Source package: [helm]

    Details (1)

    • 4.2.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 4.2.4-3.1

      Version impact unknown

      nvd · helm · opensuse · tumbleweed

  • [helm-zsh-completion]Unknown

    Source package: [helm]

    Details (1)

    • 4.2.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 4.2.4-3.1

      Version impact unknown

      nvd · helm · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]