https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T11:37:42.658127+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-envoy-2023-27496 BIT-envoy-2023-27496 — Envoy may crash when a redirect url without a state param is received in the oauth filter 2026-10-07T11:37:42.663002+00:00

Affected: Bitnami: envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redirect response. Sending it a request with the URI path equivalent to the redirect path, without the `state` parameter, will lead to abnormal termination of Envoy process. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. The issue can also be mitigated by locking down OAuth traffic, disabling the filter, or by filtering traffic before it reaches the OAuth filter (e.g. via a lua script).

 https://cve.radiocsirt.org/vuln/euvd-2026-214487 EUVD-2026-214487 2026-10-07T11:37:42.663055+00:00 EUVD-2026-214487 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27496 fkie_cve-2023-27496 2026-10-07T11:37:42.663071+00:00

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redirect response. Sending it a request with the URI path equivalent to the redirect path, without the `state` parameter, will lead to abnormal termination of Envoy process. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. The issue can also be mitigated by locking down OAuth traffic, disabling the filter, or by filtering traffic before it reaches the OAuth filter (e.g. via a lua script).

 https://cve.radiocsirt.org/vuln/gsd-2023-27496 gsd-2023-27496 2026-10-07T11:37:42.663096+00:00 gsd-2023-27496 https://cve.radiocsirt.org/vuln/rhsa-2023:4623 RHSA-2023:4623 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.9 security update 2026-10-07T11:37:42.663107+00:00

envoy: Client may fake the header `x-envoy-original-path` envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream envoy: Crash when a large request body is processed in Lua filter envoy: envoy doesn't escape HTTP header values envoy: Crash when a redirect url without a state param is received in the oauth filter

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2058 WID-SEC-W-2023-2058 — Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen 2026-10-07T11:37:42.663130+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.