CVE-2026-56121_exploit

CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.loads Unauthenticated remote code execution in the Feast feature store's registry gRPC server. The ApplyFeatureView RPC rebuilds an OnDemandFeatureView from the request proto. Doing so base64-decodes spec.userdefinedfunction.body and passes...

PT-2026-146943

Name of the Vulnerable Software and Affected Versions grpc server versions 1.0.0 through 1.0.9 grpc versions 0.8.0 through 0.9.9 Description An authorization bypass occurs when a handler acts on a resource different from the one specified in the URL of an HTTP-transcoded route. This happens becau...

PT-2026-146942

Name of the Vulnerable Software and Affected Versions elixir-grpc grpc server versions 1.0.0 through 1.0.9 Description A resource leak occurs in the grpc stream h function grpc server/src/grpc stream h.erl when the server refuses a call early, such as when the method is not implemented or the...

PT-2026-146971

Name of the Vulnerable Software and Affected Versions grpc server versions 1.0.0 through 1.0.9 grpc versions 0.3.1 through 0.9.9 Description An unauthenticated attacker can cause a denial of service by occupying a BEAM scheduler indefinitely. This occurs during client-streaming or...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP3)

An update for Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available RHBQ 3.33.4.SP3. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

CLEANSTART-2026-BJ55252 frontend gRPC server's streaming interceptor chain did not include the authorization interceptor

CVE-2026-5724 affects multiple packages. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. See references for individual vulnerability details...

EUVD-2026-105987

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-grpc-server. Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is...

CVE-2026-101579

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-grpc-server. Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is...

CVE-2026-101579

The helidon-grpc-server component within the Helidon product of Oracle Fusion Middleware is affected by a vulnerability in versions 3.0.0-3.2.21 . An unauthenticated attacker with network access via HTTP/2 can easily exploit this issue to compromise the system. Successful exploitation may lead to...

CVE-2026-102477

A flaw was found in Eclipse Vert.x vertx-grpc-server. The server's configured maximum message size limit is enforced only on the received compressed data rather than on the uncompressed payload. A remote attacker can exploit this flaw by sending a specially crafted compressed message, causing...

PT-2026-119259

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-grpc-server. Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. While the vulnerability is...

Oracle Helidon security vulnerabilities

Oracle Helidon versions 3.0.0 to 3.2.21 have security vulnerabilities. These vulnerabilities stem from issues with the helidon-grpc-server component. Unauthorized attackers may gain access through HTTP/2 networks, allowing them to perform unauthorized updates, insert or delete certain accessible...

io.gravitee.apim.gateway:gravitee-apim-gateway-tests-sdk (>=4.12.0-milestone.1, <=4.12.20), io.gravitee.singularitee.engine.api:gravitee-singularitee-engine-api (>=1.3.0, <=1.6.0) +60 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=5.0.0, <=5.1.9)

io.vertx:vertx-grpc-server MAVEN version =5.0.0, =4.12.0-milestone.1, =1.3.0, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.0.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.6.0 and more Source cves: CVE-2026-102477https://vuln...

ai.agentican:agentican-quarkus-otel (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-otel-store-jpa (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +663 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.34)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.4, =0.3.0, =0.3.0, =0.0.22, =0.0.2, =0.0.18 and more Source cves: CVE-2026-102477 Source advisory: SNYK:JAVA-IOVERTX-21715423...

ai.agentican:agentican-quarkus-otel (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-otel-store-jpa (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +663 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=4.3.0, <=4.5.34)

io.vertx:vertx-grpc-server MAVEN version =4.3.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.4, =0.3.0, =0.3.0, =0.0.22, =0.0.2, =0.0.18 and more Source cves: CVE-2026-102477 Source advisory: MEND:CVE-2026-102477...

io.mishmash.stacks.karaf:karaf-features (1.0.9), io.mishmash.stacks.osgi:wrapper-vertx (5.2.0-mmio.1.0) +10 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (5.2.0)

io.vertx:vertx-grpc-server MAVEN version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-grpc-server and may be impacted: - io.mishmash.stacks.karaf:karaf-features 1.0.9 - io.mishmash.stacks.osgi:wrapper-vertx 5.2.0-mmio.1.0 -...

io.mishmash.opentelemetry:collector-embedded (1.2.1), io.mishmash.opentelemetry:persistence-protobuf (1.2.1) +33 more potentially affected by CVE-2026-102477 via io.vertx:vertx-grpc-server (>=5.1.2, <=5.1.9)

io.vertx:vertx-grpc-server MAVEN version =5.1.2, =1.0.6, =5.1.2-mmio.1.0, =4.0.0.beta2, =0.1.0, =0.1.0, =0.3.0 - io.quarkus:quarkus-grpc 4.0.0.beta1 - io.quarkus:quarkus-grpc-common 4.0.0.beta1 and more Source cves: CVE-2026-102477 Source advisory: MEND:CVE-2026-102477...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the gzip-decoding path in GrpcReadStreamBase used by GrpcServerRequestImpl. An attacker can send a small gzip-compressed gRPC request that expands beyond the configured...

CLEANSTART-2026-AW40978 frontend gRPC server's streaming interceptor chain did not include the authorization interceptor

Security vulnerability affects the temporal-server-fips package. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor...

PT-2026-122693

Security vulnerability affects the temporal-server-fips package. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor...