agentprime: envoy

agentprime: envoyEvery new CVE for envoy.https://agentprime.io/CVE-2026-107492: Improper authentication in envoyhttps://agentprime.io/advisories/CVE-2026-107492/https://agentprime.io/advisories/CVE-2026-107492/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Nov 2026 00:43:07 GMTCVEcriticalCVE-2026-73511: Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)https://agentprime.io/advisories/CVE-2026-73511/https://agentprime.io/advisories/CVE-2026-73511/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:20:26 GMTCVECVE-2026-73553: Envoy: RBAC Authorization Bypass via Path Parametershttps://agentprime.io/advisories/CVE-2026-73553/https://agentprime.io/advisories/CVE-2026-73553/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:18:47 GMTCVECVE-2026-73551: Envoy: Path normalization does not handle dot and dotdot segments with parametershttps://agentprime.io/advisories/CVE-2026-73551/https://agentprime.io/advisories/CVE-2026-73551/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:17:02 GMTCVECVE-2026-73546: Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)https://agentprime.io/advisories/CVE-2026-73546/https://agentprime.io/advisories/CVE-2026-73546/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:53:21 GMTCVECVE-2026-73512: Envoy: use-after-free in QUIC on internal redirectshttps://agentprime.io/advisories/CVE-2026-73512/https://agentprime.io/advisories/CVE-2026-73512/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:51:23 GMTCVECVE-2026-73550: Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoyhttps://agentprime.io/advisories/CVE-2026-73550/https://agentprime.io/advisories/CVE-2026-73550/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:49:28 GMTCVECVE-2026-73547: Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null checkhttps://agentprime.io/advisories/CVE-2026-73547/https://agentprime.io/advisories/CVE-2026-73547/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:47:54 GMTCVECVE-2026-48521: Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is nullhttps://agentprime.io/advisories/CVE-2026-48521/https://agentprime.io/advisories/CVE-2026-48521/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:44:15 GMTCVECVE-2026-73549: Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clustershttps://agentprime.io/advisories/CVE-2026-73549/https://agentprime.io/advisories/CVE-2026-73549/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:42:48 GMTCVECVE-2026-73513: Envoy: oghttp2 upstream trailers incorrect handlinghttps://agentprime.io/advisories/CVE-2026-73513/https://agentprime.io/advisories/CVE-2026-73513/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:40:49 GMTCVECVE-2026-73552: Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header valueshttps://agentprime.io/advisories/CVE-2026-73552/https://agentprime.io/advisories/CVE-2026-73552/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:37:20 GMTCVECVE-2026-73548: Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend poolhttps://agentprime.io/advisories/CVE-2026-73548/https://agentprime.io/advisories/CVE-2026-73548/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:35:15 GMTCVECVE-2026-50572: Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfaulthttps://agentprime.io/advisories/CVE-2026-50572/https://agentprime.io/advisories/CVE-2026-50572/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:32:00 GMTCVECVE-2026-48090: Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)https://agentprime.io/advisories/CVE-2026-48090/https://agentprime.io/advisories/CVE-2026-48090/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 18:03:05 GMTCVECVE-2026-47220: Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log formathttps://agentprime.io/advisories/CVE-2026-47220/https://agentprime.io/advisories/CVE-2026-47220/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 18:02:17 GMTCVECVE-2026-47205: Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrideshttps://agentprime.io/advisories/CVE-2026-47205/https://agentprime.io/advisories/CVE-2026-47205/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 18:01:07 GMTCVECVE-2026-47692: Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application streamhttps://agentprime.io/advisories/CVE-2026-47692/https://agentprime.io/advisories/CVE-2026-47692/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:59:38 GMTCVECVE-2026-47207: Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC messagehttps://agentprime.io/advisories/CVE-2026-47207/https://agentprime.io/advisories/CVE-2026-47207/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:52:27 GMTCVECVE-2026-48706: Envoy Heap Buffer Overflow in TcpStatsdSinkhttps://agentprime.io/advisories/CVE-2026-48706/https://agentprime.io/advisories/CVE-2026-48706/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:38:23 GMTCVECVE-2026-47204: Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routeshttps://agentprime.io/advisories/CVE-2026-47204/https://agentprime.io/advisories/CVE-2026-47204/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:37:17 GMTCVECVE-2026-47221: Envoy: Null pointer deref in internal redirectshttps://agentprime.io/advisories/CVE-2026-47221/https://agentprime.io/advisories/CVE-2026-47221/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:35:29 GMTCVECVE-2026-48743: Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Lengthhttps://agentprime.io/advisories/CVE-2026-48743/https://agentprime.io/advisories/CVE-2026-48743/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:34:22 GMTCVECVE-2026-48497: Envoy: Abnormal process termination in DNS UDP filterhttps://agentprime.io/advisories/CVE-2026-48497/https://agentprime.io/advisories/CVE-2026-48497/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:32:58 GMTCVECVE-2026-48044: Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosionhttps://agentprime.io/advisories/CVE-2026-48044/https://agentprime.io/advisories/CVE-2026-48044/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:31:37 GMTCVECVE-2026-48042: Envoy: Stack overflow in destructor of highly nested JSONhttps://agentprime.io/advisories/CVE-2026-48042/https://agentprime.io/advisories/CVE-2026-48042/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:29:14 GMTCVECVE-2026-47778: Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)https://agentprime.io/advisories/CVE-2026-47778/https://agentprime.io/advisories/CVE-2026-47778/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:27:57 GMTCVECVE-2026-47775: Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryptionhttps://agentprime.io/advisories/CVE-2026-47775/https://agentprime.io/advisories/CVE-2026-47775/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 17:23:51 GMTCVECVE-2026-47774: Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationhttps://agentprime.io/advisories/CVE-2026-47774/https://agentprime.io/advisories/CVE-2026-47774/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 16:58:36 GMTCVECVE-2026-6994: Envoy Query Parameter header_mutation.cc params.add injectionhttps://agentprime.io/advisories/CVE-2026-6994/https://agentprime.io/advisories/CVE-2026-6994/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 25 Apr 2026 19:00:19 GMTCVECVE-2025-62504: Envoy Lua filter use-after-free when oversized rewritten response body causes crashhttps://agentprime.io/advisories/CVE-2025-62504/https://agentprime.io/advisories/CVE-2025-62504/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 21:23:41 GMTCVECVE-2025-62409: Envoy allows large requests and responses to cause TCP connection pool crashhttps://agentprime.io/advisories/CVE-2025-62409/https://agentprime.io/advisories/CVE-2025-62409/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 17:47:25 GMTCVECVE-2025-55162: Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flaghttps://agentprime.io/advisories/CVE-2025-55162/https://agentprime.io/advisories/CVE-2025-55162/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 03 Sep 2025 19:51:51 GMTCVECVE-2025-46821: Envoy vulnerable to bypass of RBAC uri_template permissionhttps://agentprime.io/advisories/CVE-2025-46821/https://agentprime.io/advisories/CVE-2025-46821/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 May 2025 21:24:07 GMTCVECVE-2024-53271: HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoyhttps://agentprime.io/advisories/CVE-2024-53271/https://agentprime.io/advisories/CVE-2024-53271/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Dec 2024 19:12:20 GMTCVECVE-2024-53270: HTTP/1: sending overload crashes when the request is reset beforehand in envoyhttps://agentprime.io/advisories/CVE-2024-53270/https://agentprime.io/advisories/CVE-2024-53270/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Dec 2024 19:12:18 GMTCVECVE-2024-53269: Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoyhttps://agentprime.io/advisories/CVE-2024-53269/https://agentprime.io/advisories/CVE-2024-53269/CVSS 4.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Dec 2024 19:12:17 GMTCVECVE-2024-45806: Potential manipulate `x-envoy` headers from external sources in envoyhttps://agentprime.io/advisories/CVE-2024-45806/https://agentprime.io/advisories/CVE-2024-45806/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Sep 2024 23:34:30 GMTCVECVE-2024-45807: oghttp2 crash on OnBeginHeadersForStream in envoyhttps://agentprime.io/advisories/CVE-2024-45807/https://agentprime.io/advisories/CVE-2024-45807/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Sep 2024 23:34:28 GMTCVECVE-2024-45808: Malicious log injection via access logs in envoyhttps://agentprime.io/advisories/CVE-2024-45808/https://agentprime.io/advisories/CVE-2024-45808/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Sep 2024 23:34:26 GMTCVECVE-2024-45809: Jwt filter crash in the clear route cache with remote JWKs in envoyhttps://agentprime.io/advisories/CVE-2024-45809/https://agentprime.io/advisories/CVE-2024-45809/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Sep 2024 23:34:24 GMTCVECVE-2024-45810: Envoy crashes for LocalReply in http async clienthttps://agentprime.io/advisories/CVE-2024-45810/https://agentprime.io/advisories/CVE-2024-45810/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Sep 2024 23:34:22 GMTCVECVE-2024-39305: Envoy Proxy use after free when route hash policy is configured with cookie attributeshttps://agentprime.io/advisories/CVE-2024-39305/https://agentprime.io/advisories/CVE-2024-39305/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jul 2024 21:10:23 GMTCVECVE-2024-32974: Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()https://agentprime.io/advisories/CVE-2024-32974/https://agentprime.io/advisories/CVE-2024-32974/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Jun 2024 21:00:07 GMTCVECVE-2024-32975: Envoy crashes in QuicheDataReader::PeekVarInt62Length()https://agentprime.io/advisories/CVE-2024-32975/https://agentprime.io/advisories/CVE-2024-32975/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Jun 2024 21:00:03 GMTCVECVE-2024-32976: Envoy can enter an endless loop while decompressing Brotli data with extra inputhttps://agentprime.io/advisories/CVE-2024-32976/https://agentprime.io/advisories/CVE-2024-32976/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Jun 2024 20:59:59 GMTCVECVE-2024-34362: Envoy affected by a crash (use-after-free) in EnvoyQuicServerStreamhttps://agentprime.io/advisories/CVE-2024-34362/https://agentprime.io/advisories/CVE-2024-34362/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Jun 2024 20:59:56 GMTCVECVE-2024-34363: Envoy can crash due to uncaught nlohmann JSON exceptionhttps://agentprime.io/advisories/CVE-2024-34363/https://agentprime.io/advisories/CVE-2024-34363/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Jun 2024 20:59:52 GMTCVECVE-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror responsehttps://agentprime.io/advisories/CVE-2024-34364/https://agentprime.io/advisories/CVE-2024-34364/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Jun 2024 20:59:48 GMTCVECVE-2024-23326: Envoy incorrectly accepts HTTP 200 response for entering upgrade modehttps://agentprime.io/advisories/CVE-2024-23326/https://agentprime.io/advisories/CVE-2024-23326/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Jun 2024 20:05:48 GMTCVE