PT-2025-9996

🗓️ 06 Mar 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Envoy Gateway access log allows log injection via crafted user agents; upgrade to 1.2.7 and 1.3.1.

Reporter	Title	Published	Views	Family All 2793
OSV	CGA-XX5P-Q498-46FM	31 Mar 202516:03	–	osv
OSV	CGA-XX92-W583-393P	31 Mar 202516:03	–	osv
OSV	CGA-XX9C-FWPQ-HW55	31 Mar 202516:03	–	osv
OSV	CGA-XXFH-X57M-GR58	31 Mar 202516:03	–	osv
OSV	CGA-XXGG-XWJC-7MVR	31 Mar 202516:03	–	osv
OSV	CGA-XXR2-5MCW-H927	31 Mar 202516:03	–	osv
OSV	CGA-XXRG-CMP9-9VHM	28 Feb 202500:10	–	osv
OSV	CLEANSTART-2025-ZR62045 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing	30 Jan 202616:56	–	osv
OSV	CLEANSTART-2026-MW42038 Security fixes for CVE-2019-16884, CVE-2019-19921, CVE-2019-5736, CVE-2021-30465, CVE-2021-43784, CVE-2022-29162, CVE-2023-25809, CVE-2023-27561, CVE-2023-28642, CVE-2024-21626, CVE-2024-45310, CVE-2024-45338, CVE-2025-0913, CVE-2025-22870, CVE-2025-22871, CVE-2025-22872, CVE-2025-22873, CVE-2025-4673, CVE-2025-4674, CVE-2025-47906, CVE-2025-47907, CVE-2025-47911, CVE-2025-47912, CVE-2025-52881, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-58190, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-65637, CVE-2025-68121, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, ghsa-4f99-4q7p-p3gh, ghsa-cgrx-mc8f-2prm, ghsa-qxp5-gwg8-xv66, ghsa-vvgc-356p-c3xw applied in versions: 1.0.0_rc10-r0, 1.0.0_rc7-r0, 1.0.0_rc9-r0, 1.0.0_rc95-r0, 1.0.3-r0, 1.1.12-r0, 1.1.14-r0, 1.1.2-r0, 1.1.4-r0, 1.1.4-r7, 1.4.2-r0, 1.4.2-r1	21 Jul 202611:18	–	osv
OSV	CLEANSTART-2026-RF96040 Security fixes for CVE-2023-45288, CVE-2023-48795, CVE-2024-24786, CVE-2024-45337, CVE-2024-45338, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870, CVE-2025-22872, CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 2.10.1-r0, 2.10.1-r1, 2.10.1-r2	13 Jul 202608:02	–	osv

Source	Link
suse	www.suse.com/security/cve/CVE-2025-27100
suse	www.suse.com/security/cve/CVE-2025-25294
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-25294
osv	www.osv.dev/vulnerability/GO-2025-3504
github	www.github.com/envoyproxy/gateway/commit/358bed50dcb7b32f39a2edb252fb1399c7fc65dc
suse	www.suse.com/security/cve/CVE-2025-20051
suse	www.suse.com/security/cve/CVE-2025-27155
suse	www.suse.com/security/cve/CVE-2025-27509
osv	www.osv.dev/vulnerability/BIT-envoy-gateway-2025-25294
suse	www.suse.com/security/cve/CVE-2025-27421

09 Sep 2025 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3 - 9.9

CVSS 49.3

EPSS0.9384

SSVC