https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:39:53 +0000 https://cve.radiocsirt.org/vuln/bit-envoy-2026-48706 <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy&#39;s TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., &gt;16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.</p> <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy&#39;s TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., &gt;16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.</p> https://cve.radiocsirt.org/vuln/bit-envoy-2026-48706 https://cve.radiocsirt.org/vuln/euvd-2026-330762 EUVD-2026-330762 https://cve.radiocsirt.org/vuln/euvd-2026-330762 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48706 <p>Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy&#39;s TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., &gt;16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy&#39;s TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., &gt;16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48706 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11141-1 <p>istioctl-1.30.2-1.1 on GA media</p> <p>istioctl-1.30.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11141-1 https://cve.radiocsirt.org/vuln/rhsa-2026:49729 <p>crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries envoy: Envoy: Denial of Service via Connect protocol request envoy: Envoy: Null pointer deref in internal redirects envoy: Envoy: Denial of Service via deeply nested JSON objects Envoy: Envoy: Denial of Service via specially crafted zstd payload envoy: Envoy Heap Buffer Overflow in TcpStatsdSink</p> <p>crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries envoy: Envoy: Denial of Service via Connect protocol request envoy: Envoy: Null pointer deref in internal redirects envoy: Envoy: Denial of Service via deeply nested JSON objects Envoy: Envoy: Denial of Service via specially crafted zstd payload envoy: Envoy Heap Buffer Overflow in TcpStatsdSink</p> https://cve.radiocsirt.org/vuln/rhsa-2026:49729 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2048 <p>Ein Angreifer kann mehrere Schwachstellen in Google Cloud Service Mesh und Envoy Proxy ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Google Cloud Service Mesh und Envoy Proxy ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2048