https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:03:13 +0000 https://cve.radiocsirt.org/vuln/bit-envoy-2024-23326 <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.</p> <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.</p> https://cve.radiocsirt.org/vuln/bit-envoy-2024-23326 https://cve.radiocsirt.org/vuln/euvd-2026-3999 EUVD-2026-3999 https://cve.radiocsirt.org/vuln/euvd-2026-3999 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23326 <p>Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.</p> <p>Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-23326 https://cve.radiocsirt.org/vuln/gsd-2024-23326 gsd-2024-23326 https://cve.radiocsirt.org/vuln/gsd-2024-23326 https://cve.radiocsirt.org/vuln/rhsa-2024:7725 <p>envoy: Envoy incorrectly accepts HTTP 200 response for entering upgrade mode envoy: HTTP/2 CPU exhaustion due to CONTINUATION frame flood envoy: abnormal termination when using auto_sni with authority header longer than 255 characters envoy: Brotli decompressor infinite loop webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule send: Code Execution Vulnerability in Send Library serve-static: Improper Sanitization in serve-static body-parser: Denial of Service Vulnerability in body-parser envoy: Potential to manipulate `x-envoy` headers from external sources</p> <p>envoy: Envoy incorrectly accepts HTTP 200 response for entering upgrade mode envoy: HTTP/2 CPU exhaustion due to CONTINUATION frame flood envoy: abnormal termination when using auto_sni with authority header longer than 255 characters envoy: Brotli decompressor infinite loop webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule send: Code Execution Vulnerability in Send Library serve-static: Improper Sanitization in serve-static body-parser: Denial of Service Vulnerability in body-parser envoy: Potential to manipulate `x-envoy` headers from external sources</p> https://cve.radiocsirt.org/vuln/rhsa-2024:7725