CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC

Q: How do I fix CVE-2026-33186?

grpc: upgrade to 1.79.3. Exact commands for each OS are on this page.

Q: Is CVE-2026-33186 being exploited?

CVE-2026-33186 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-33186 affect?

CVE-2026-33186 affects grpc. Severity is critical (CVSS 9.1). gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic,

Q: How urgent is CVE-2026-33186?

Priority 56/100. Critical severity; Remotely exploitable, no login, no user action

This month

CRITICAL 9.1REMOTEUPGRADE

CVE-2026-33186 is a critical-severity flaw (CVSS 9.1) affecting grpc. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, author

Why this priority

Critical severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.1 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.6% (top 25%)
CISA exploited list	No
Weakness	CWE-285, CWE-551
Published	2026-03-20
Last modified	2026-09-18

Publisher (CNA): GitHub, Inc. · Vendor: grpc

Last updated 2026-09-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-03-20 23:16 UTCPublished CVE record published
2026-09-18 13:17 UTCUpdated Record last modified

grpc grpc UPGRADE

Affected: < 1.79.3

Fixed in: 1.79.3

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy grpc || rpm -q grpc || grpc --version

2. UPGRADE to 1.79.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade grpc

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade grpc

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Go · google.golang.org/grpc · FIXED · 1.79.3 · vulnerable: < 1.79.3 · source

go get google.golang.org/grpc@v1.79.3 go list -m google.golang.org/grpc

Fedora ELN · openldap · FIXED · 2.6.16-1.eln159 · FEDORA-2026-4b30c86326 · source

sudo dnf upgrade --advisory=FEDORA-2026-4b30c86326

Fedora 46 · php-pecl-yac · FIXED · 3.0.1-2.fc46 · FEDORA-2026-5f43289aa2 · source

sudo dnf upgrade --advisory=FEDORA-2026-5f43289aa2

Debian 12 · golang-google-grpc · NO FIX YET

Debian 13 · golang-google-grpc · NO FIX YET

RHEL 10 · opentelemetry-collector · FIXED · opentelemetry-collector-0.144.0-2.el10_2

sudo dnf upgrade --advisory=RHSA-2026:19135 rpm -q opentelemetry-collector

RHEL 10 · osbuild-composer · FIXED · osbuild-composer-165.1-2.el10_2

sudo dnf upgrade --advisory=RHSA-2026:22450 rpm -q osbuild-composer

RHEL 10 · image-builder · FIXED · image-builder-52.1-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:22937 rpm -q image-builder

RHEL 10.0 Extended Update Support · opentelemetry-collector · FIXED · opentelemetry-collector-0.144.0-2.el10_0

sudo dnf upgrade --advisory=RHSA-2026:19719 rpm -q opentelemetry-collector

RHEL 10.0 Extended Update Support · osbuild-composer · FIXED · osbuild-composer-134.1-9.el10_0

sudo dnf upgrade --advisory=RHSA-2026:27856 rpm -q osbuild-composer

Alpine 3.24 · rclone · FIXED · rclone-1.73.5-r0

apk add --upgrade rclone apk info -v rclone

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-1607 · source

sudo dnf update --advisory=ALAS2023-2026-1607

Amazon Linux 2 · see advisory · FIXED · ALAS2-2026-3264 · source

sudo yum update --advisory=ALAS2-2026-3264

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: JohannesLks/CVE-2026-33186 (1 stars)

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-33186?

grpc: upgrade to 1.79.3. Exact commands for each OS are on this page.

Is CVE-2026-33186 being exploited?

CVE-2026-33186 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-33186 affect?

CVE-2026-33186 affects grpc. Severity is critical (CVSS 9.1). gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic,

How urgent is CVE-2026-33186?

Priority 56/100. Critical severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2024-7246 MEDIUM 5.3 UPGRADE It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy
CVE-2024-11407 HIGH 7.5 UPGRADE There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero cop

References

← Back to latest CVEs