grpc-gateway v2.28.0 parses the X-HTTP-Method-Override header in ServeMux.ServeHTTP without validating the target method. When an attacker sends a POST request with Content-Type application/x-www-form-urlencoded and supplies this header, the server changes the request method to an arbitrary value before routing. This flaw allows the requester to alter the HTTP method used for the downstream service, effectively bypassing any method-based access controls, such as those enforced by upstream proxies or web application firewalls. The effect is that endpoints protected by method restrictions can be accessed with an unsupported HTTP verb, potentially exposing functionality that should be restricted. The CVSS score of 9.8 indicates very high severity.

The vulnerability affects the grpc‑gateway library, version 2.28.0. Any application that integrates this library and accepts X-HTTP-Method-Override headers is potentially impacted; the flaw exists in the ServeMux.ServeHTTP implementation of that version.

The CVSS score of 9.8 indicates a high severity vulnerability, and the EPSS score of < 1% suggests a low yet non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires only the ability to send an HTTP request with a custom header, which can be performed from any network that can reach the application. The attacker can choose any HTTP method, so the risk is the potential to circumvent method‑based controls and access otherwise protected functionality. Because the flaw operates during normal request processing, it may be usable by remote attackers without additional privilege elevation.