PT-2026-83123
CVE-2026-37236
·
تاريخ النشر
2026-08-28
·
تاريخ التحديث
2026-10-06
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
grpc-gateway version 2.28.0
Description
Incorrect Access Control occurs because the application processes the
X-HTTP-Method-Override header in the ServeMux.ServeHTTP() function without restricting allowed methods. When a POST request with Content-Type set to application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary value provided by the attacker before routing. This behavior enables the bypass of method-based access controls enforced by Web Application Firewalls (WAFs) or upstream proxies.Recommendations
Update grpc-gateway version 2.28.0 to a newer version that contains a fix for this issue.
As a temporary mitigation, restrict or filter the
X-HTTP-Method-Override header at the proxy or WAF level before it reaches the application.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾