https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:52:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-30445 EUVD-2026-30445 https://cve.radiocsirt.org/vuln/euvd-2026-30445 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39156 <p>Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.</p> <p>Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-39156 https://cve.radiocsirt.org/vuln/ghsa-hqxw-mm44-gc4r <p><strong>Affected:</strong> Go: istio.io/istio</p> <p>### Impact Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies.</p> <p>### Patches * Istio 1.11.1 and above * Istio 1.10.4 and above * Istio 1.9.8 and above</p> <p>### Workarounds A Lua filter may be written to normalize the path. This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.</p> <p>### References More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)</p> <p>### For more information If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com</p> <p><strong>Affected:</strong> Go: istio.io/istio</p> <p>### Impact Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies.</p> <p>### Patches * Istio 1.11.1 and above * Istio 1.10.4 and above * Istio 1.9.8 and above</p> <p>### Workarounds A Lua filter may be written to normalize the path. This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.</p> <p>### References More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)</p> <p>### For more information If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com</p> https://cve.radiocsirt.org/vuln/ghsa-hqxw-mm44-gc4r https://cve.radiocsirt.org/vuln/gsd-2021-39156 gsd-2021-39156 https://cve.radiocsirt.org/vuln/gsd-2021-39156 https://cve.radiocsirt.org/vuln/rhsa-2021:3272 <p>envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies envoyproxy/envoy: denial of service when using extensions that modify request or response sizes istio/istio: HTTP request can bypass authorization mechanisms due to case insensitive host comparison istio/istio: HTTP request with fragment in URI can bypass authorization mechanisms</p> <p>envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies envoyproxy/envoy: denial of service when using extensions that modify request or response sizes istio/istio: HTTP request can bypass authorization mechanisms due to case insensitive host comparison istio/istio: HTTP request with fragment in URI can bypass authorization mechanisms</p> https://cve.radiocsirt.org/vuln/rhsa-2021:3272