https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T10:04:36.947256+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2019-02074 bdu:2019-02074 2026-10-09T10:04:36.950918+00:00 bdu:2019-02074 https://cve.radiocsirt.org/vuln/euvd-2026-53204 EUVD-2026-53204 2026-10-09T10:04:36.950950+00:00 EUVD-2026-53204 https://cve.radiocsirt.org/vuln/fkie_cve-2019-9900 fkie_cve-2019-9900 2026-10-09T10:04:36.950964+00:00

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

 https://cve.radiocsirt.org/vuln/ghsa-h9r7-c397-3wqr GHSA-h9r7-c397-3wqr 2026-10-09T10:04:36.950992+00:00

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

 https://cve.radiocsirt.org/vuln/gsd-2019-9900 gsd-2019-9900 2026-10-09T10:04:36.951008+00:00 gsd-2019-9900 https://cve.radiocsirt.org/vuln/rhsa-2019:0741 RHSA-2019:0741 — Red Hat Security Advisory: Istio-Proxy Security Update 2026-10-09T10:04:36.951019+00:00

istio/envoy: Authorization bypass via null characters injection in HTTP/1.x istio/envoy: Path traversal via URL Patch manipulation in HTTP/1.x header