Threats Tagged 'cve-2026-41888'

This security update for the hauler component addresses multiple vulnerabilities including authentication bypass and deadlocks in the golang.org/x/crypto/ssh library, as well as denial of service (DoS) issues in google.golang.org/grpc caused by missing ':authority' and 'Host' headers. The update advances hauler to version 2.1.0 and fixes several CVEs (CVE-2026-41888, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, CVE-2026-84303, CVE-2026-84304, CVE-2026-84445). The vulnerabilities are rated critical and a patch is available. No known exploits in the wild have been reported.

grpc-gateway version 2.28.0 has an incorrect access control vulnerability related to processing the X-HTTP-Method-Override header in ServeMux.ServeHTTP. The application does not restrict allowed HTTP methods properly, which can lead to unintended method overrides when a POST request with Content-Type application/x-www-form-urlencoded is processed. This vulnerability has been assigned CVE-2026-37236 and is rated medium severity. No CVSS score or patch information is currently available. The affected versions include grpc-gateway v2.28.0 and related Microsoft and SUSE products as listed. No known exploits are reported in the wild at this time.