https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 14:03:14 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-02000 bdu:2023-02000 https://cve.radiocsirt.org/vuln/bdu:2023-02000 https://cve.radiocsirt.org/vuln/bit-envoy-2023-27493 <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.</p> <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.</p> https://cve.radiocsirt.org/vuln/bit-envoy-2023-27493 https://cve.radiocsirt.org/vuln/euvd-2026-214663 EUVD-2026-214663 https://cve.radiocsirt.org/vuln/euvd-2026-214663 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27493 <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-27493 https://cve.radiocsirt.org/vuln/gsd-2023-27493 gsd-2023-27493 https://cve.radiocsirt.org/vuln/gsd-2023-27493 https://cve.radiocsirt.org/vuln/rhsa-2023:4623 <p>envoy: Client may fake the header `x-envoy-original-path` envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream envoy: Crash when a large request body is processed in Lua filter envoy: envoy doesn&#39;t escape HTTP header values envoy: Crash when a redirect url without a state param is received in the oauth filter</p> <p>envoy: Client may fake the header `x-envoy-original-path` envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream envoy: Crash when a large request body is processed in Lua filter envoy: envoy doesn&#39;t escape HTTP header values envoy: Crash when a redirect url without a state param is received in the oauth filter</p> https://cve.radiocsirt.org/vuln/rhsa-2023:4623 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2058 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2058