envoy vulnerabilities (Bitnami)
118 vulnerabilities.
envoyBitnamiA flaw was found in Envoy. It is possible to modify or manipulate headers from external clients...8.2 HighenvoyBitnamiEnvoy Proxy use after free when route hash policy is configured with cookie attributes6.5 MediumenvoyBitnamiEnvoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()5.9 MediumenvoyBitnamiEnvoy crashes in QuicheDataReader::PeekVarInt62Length()5.9 MediumenvoyBitnamiEnvoy can enter an endless loop while decompressing Brotli data with extra input7.5 HighenvoyBitnamiEnvoy affected by a crash (use-after-free) in EnvoyQuicServerStream5.9 MediumenvoyBitnamiEnvoy can crash due to uncaught nlohmann JSON exception7.5 HighenvoyBitnamiEnvoy OOM vector from HTTP async client with unbounded response buffer for mirror response5.7 MediumenvoyBitnamiEnvoy incorrectly accepts HTTP 200 response for entering upgrade mode5.9 MediumenvoyBitnamiEnvoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes7.5 HighenvoyBitnamiHTTP/2: CPU exhaustion due to CONTINUATION frame flood5.3 MediumenvoyBitnamiHTTP/2: memory exhaustion due to CONTINUATION frame flood7.5 HighenvoyBitnamiEnvoy crashes when idle and request per try timeout occur within the backoff interval7.5 HighenvoyBitnamiExcessive CPU usage when URI template matcher is configured using regex in Envoy4.3 MediumenvoyBitnamiEnvoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata8.6 HighenvoyBitnamiEnvoy crashes when using an address type that isn’t supported by the OS7.5 HighenvoyBitnamiCrash in proxy protocol when command type of LOCAL in Envoy7.5 HighenvoyBitnamiEnvoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes8.2 HighenvoyBitnamiEnvoy vulnerable to CORS filter segfault when origin header is removed6.3 MediumenvoyBitnamiEnvoy's gRPC access log crash caused by the listener draining6.5 MediumenvoyBitnamiEnvoy vulnerable to OAuth2 credentials exploit with permanent validity8.6 HighenvoyBitnamiEnvoy vulnerable to HTTP/2 memory leak in nghttp2 codec7.5 HighenvoyBitnamiEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 HighenvoyBitnamiEnvoy may crash when a redirect url without a state param is received in the oauth filter6.5 MediumenvoyBitnamiEnvoy doesn't escape HTTP header values8.1 HighenvoyBitnamiEnvoy may crash when a large request body is processed in Lua filter4.8 MediumenvoyBitnamiEnvoy forwards invalid Http2/Http3 downstream headers5.4 MediumenvoyBitnamiEnvoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.5.4 MediumenvoyBitnamiEnvoy client may fake the header `x-envoy-original-path`8.2 HighenvoyBitnamiUse after free in Envoy7.5 HighenvoyBitnamiTrivial authentication bypass in Envoy10.0 CriticalenvoyBitnamiReachable assertion in Envoy7.5 HighenvoyBitnamiZip bomb vulnerability in Envoy7.5 HighenvoyBitnamiSegmentation fault leading to crash in Envoy5.9 MediumenvoyBitnamiCrash when tunneling TCP over HTTP in Envoy7.5 HighenvoyBitnamiUse-after-free in Envoy6.1 MediumenvoyBitnamiIncorrect handling of internal redirects results in crash in Envoy7.5 HighenvoyBitnamiIncorrect configuration handling allows TLS session re-use without re-validation in Envoy7.4 HighenvoyBitnamiX.509 Extended Key Usage and Trust Purposes bypass in Envoy6.8 MediumenvoyBitnamiX.509 subjectAltName matching bypass in Envoy7.4 HighenvoyBitnamiCrash when a cluster is deleted in Envoy4.4 MediumenvoyBitnamiNull pointer dereference in envoy7.5 HighenvoyBitnamiIncorrect Authorization with specially crafted requests8.6 HighenvoyBitnamiExcessive CPU usage in Pomerium7.5 HighenvoyBitnamiIncorrect handling of H2 GOAWAY + SETTINGS frames8.6 HighenvoyBitnamiIncorrect handling of H/2 GOAWAY followed by SETTINGS frames8.6 HighenvoyBitnamiContinued processing of requests after locally generated response8.6 HighenvoyBitnamiIncorrectly handling of URI '#fragment' element as part of the path element8.6 HighenvoyBitnamiExcessive CPU utilization when closing HTTP/2 streams5.8 MediumenvoyBitnamiIncorrect concatenation of multiple value request headers in ext-authz extension8.6 High- Show moreLoading…