DEBIAN-CVE-2026-33186
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers wi
DEBIAN-CVE-2026-33186
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-33186
golang-google-grpc
Source reference: /affected/0/package/name
- Affected versions
- 1.33.3-2
Source reference:
/affected/0/versions1.38.0+really1.33.3-1Source reference:
/affected/0/versions1.38.0-1Source reference:
/affected/0/versions1.38.0-2Source reference:
/affected/0/versions1.38.0-3Source reference:
/affected/0/versions1.38.0-4Source reference:
/affected/0/versions1.38.0-5Source reference:
/affected/0/versions1.38.1-1Source reference:
/affected/0/versions1.59.0-1Source reference:
/affected/0/versions1.60.1-1Source reference:
/affected/0/versions1.60.1-2Source reference:
/affected/0/versions1.64.0-1Source reference:
/affected/0/versions1.64.0-2Source reference:
/affected/0/versions1.64.0-3Source reference:
/affected/0/versions1.64.0-4Source reference:
/affected/0/versions1.64.0-5Source reference:
/affected/0/versions1.64.0-6Source reference:
/affected/0/versions1.64.0-7Source reference:
/affected/0/versions1.66.3-1Source reference:
/affected/0/versions1.66.3-2Source reference:
/affected/0/versions1.75.1-1Source reference:
/affected/0/versions1.79.3-1Source reference:
/affected/0/versions1.79.3-1~bpo13+1Source reference:
/affected/0/versions1.81.1-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
golang-google-grpc
Source reference: /affected/1/package/name
- Affected versions
- 1.64.0-7
Source reference:
/affected/1/versions1.66.3-1Source reference:
/affected/1/versions1.66.3-2Source reference:
/affected/1/versions1.75.1-1Source reference:
/affected/1/versions1.79.3-1Source reference:
/affected/1/versions1.79.3-1~bpo13+1Source reference:
/affected/1/versions1.81.1-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
golang-google-grpc
Source reference: /affected/2/package/name
- Affected versions
- 1.64.0-7
Source reference:
/affected/2/versions1.66.3-1Source reference:
/affected/2/versions1.66.3-2Source reference:
/affected/2/versions1.75.1-1Source reference:
/affected/2/versions1.79.3-1~bpo13+1Source reference:
/affected/2/versions - Fixed versions
- 1.79.3-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-google-grpc",
"purl": "pkg:deb/debian/golang-google-grpc?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.33.3-2",
"1.38.0+really1.33.3-1",
"1.38.0-1",
"1.38.0-2",
"1.38.0-3",
"1.38.0-4",
"1.38.0-5",
"1.38.1-1",
"1.59.0-1",
"1.60.1-1",
"1.60.1-2",
"1.64.0-1",
"1.64.0-2",
"1.64.0-3",
"1.64.0-4",
"1.64.0-5",
"1.64.0-6",
"1.64.0-7",
"1.66.3-1",
"1.66.3-2",
"1.75.1-1",
"1.79.3-1",
"1.79.3-1~bpo13+1",
"1.81.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33186.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "golang-google-grpc",
"purl": "pkg:deb/debian/golang-google-grpc?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.64.0-7",
"1.66.3-1",
"1.66.3-2",
"1.75.1-1",
"1.79.3-1",
"1.79.3-1~bpo13+1",
"1.81.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33186.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.79.3-1"
}
]
}
],
"package": {
"name": "golang-google-grpc",
"purl": "pkg:deb/debian/golang-google-grpc?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.64.0-7",
"1.66.3-1",
"1.66.3-2",
"1.75.1-1",
"1.79.3-1~bpo13+1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33186.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55941 · Revision 1
- Added to Heist Feed
- Publisher date