From 36cb562576fad7139ad62b8a37a225bdf7a407c5 Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Wed, 14 Oct 2026 22:17:17 -0700 Subject: [PATCH] python3-grpcio-tools: set status for CVE-2026-33186 The vulnerability only affects the Go implementation of the library, not the Python one. Ignore this CVE due to this. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33186 https://github.com/advisories/GHSA-p77j-4mvh-x3m3 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../recipes-devtools/python/python3-grpcio-tools_1.76.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb b/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb index 1733dd0e88..1133e2c9da 100644 --- a/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb +++ b/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb @@ -28,3 +28,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_PRODUCT += "grpc:grpc" CVE_STATUS[CVE-2023-33953] = "fixed-version: Fixed since 1.56.2" CVE_STATUS[CVE-2024-37168] = "cpe-incorrect: affects @grpc/grpc-js, not gRPC core" +CVE_STATUS[CVE-2026-33186] = "cpe-incorrect: affects gRPC-Go, not Python grpcio-tools"