https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:00:33 +0000 https://cve.radiocsirt.org/vuln/bit-envoy-2026-73550 <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> https://cve.radiocsirt.org/vuln/bit-envoy-2026-73550 https://cve.radiocsirt.org/vuln/euvd-2026-377845 EUVD-2026-377845 https://cve.radiocsirt.org/vuln/euvd-2026-377845 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73550 <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-73550 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11630-1 <p>istioctl-1.30.4-1.1 on GA media</p> <p>istioctl-1.30.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11630-1 https://cve.radiocsirt.org/vuln/rhsa-2026:65106 <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls envoy: envoy: ext_authz use-after-free after rejecting an HTTP request net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages envoy: envoy: path matching bypass via per-segment parameters not stripped by router envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free envoy: envoy: stored XSS through dynamically generated stat names in admin interface envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values e…</p> <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls envoy: envoy: ext_authz use-after-free after rejecting an HTTP request net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages envoy: envoy: path matching bypass via per-segment parameters not stripped by router envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free envoy: envoy: stored XSS through dynamically generated stat names in admin interface envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values e…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:65106