RHSA-2026:56959 | Vulnetix

RHSA-2026:56959 PUBLISHED CVSS 9.100000381469727 CRITICAL

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

Risk Scores

CVSS 3.1

9.100000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Red Hat	osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-core-0:101.3-4.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-core-debuginfo-0:101.3-4.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-debugsource-0:101.3-4.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-0:101.3-4.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-debuginfo-0:101.3-4.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-worker-debuginfo-0:101.3-4.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-core-0:101.3-4.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-0:101.3-4.el9_4.4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-0:101.3-4.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-worker-0:101.3-4.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-debuginfo-0:101.3-4.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-0:101.3-4.el9_4.4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-core-0:101.3-4.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-tests-debuginfo-0:101.3-4.el9_4.4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4
Red Hat	osbuild-composer-core-debuginfo-0:101.3-4.el9_4.4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)	0:101.3-4.el9_4.4

…and 13 more

Timeline

Aug 19, 2026 CVE Published
Sep 9, 2026 CVE Updated
Sep 9, 2026 Distribution Patch
Sep 9, 2026 Distribution Patch
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory

References

Open in Interactive Console →