GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc...

GHSA-P77J-4MVH-X3M3 gRPC-Go has an authorization bypass via missing leading slash in :path

Impact What kind of vulnerability is it? Who is impacted? It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash e.g.,...

CVE-2002-1557: Undefined Security Weakness

Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service reset to TCC, TCC+, TCCi or XTC via a malformed HTTP request that does not contain a leading / slash character...