https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:03:17.487017+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-02000 bdu:2023-02000 2026-10-07T14:03:17.492623+00:00 bdu:2023-02000 https://cve.radiocsirt.org/vuln/bit-envoy-2023-27493 BIT-envoy-2023-27493 — Envoy doesn't escape HTTP header values 2026-10-07T14:03:17.492659+00:00

Affected: Bitnami: envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.

 https://cve.radiocsirt.org/vuln/euvd-2026-214663 EUVD-2026-214663 2026-10-07T14:03:17.492698+00:00 EUVD-2026-214663 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27493 fkie_cve-2023-27493 2026-10-07T14:03:17.492712+00:00

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.

 https://cve.radiocsirt.org/vuln/gsd-2023-27493 gsd-2023-27493 2026-10-07T14:03:17.492737+00:00 gsd-2023-27493 https://cve.radiocsirt.org/vuln/rhsa-2023:4623 RHSA-2023:4623 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.9 security update 2026-10-07T14:03:17.492748+00:00

envoy: Client may fake the header `x-envoy-original-path` envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream envoy: Crash when a large request body is processed in Lua filter envoy: envoy doesn't escape HTTP header values envoy: Crash when a redirect url without a state param is received in the oauth filter

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2058 WID-SEC-W-2023-2058 — Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen 2026-10-07T14:03:17.492773+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.