CVE-2026-37236

grpc-gateway v2.28.0 contains an Incorrect Access Control flaw in its ServeMux.ServeHTTP handler. The component processes the X-HTTP-Method-Override header without restricting which HTTP methods are permitted. When a POST request with Content-Type: application/x-www-form-urlencoded carries this h...

EUVD-2026-67776

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the NewServer function in the HTTP server, specifically within the http.DefaultServeMux Fallback Handler. An attacker can access sensitive information by sending crafted HTTP requests that trigger the unintend...