CVE-2026-22726 Route Services Firewall Bypass

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks...

EUVD-2020-26580

Malware in sbrugna...

EUVD-2021-0951

Malware in sbrugna...

PT-2024-19299

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing Release versions 0.273.0 through 0.297.0 Description The issue is related to improper handling of requests, which can be exploited by an unauthenticated attacker to degrade the service availability of the Cloud Foundry...

PT-2024-12464 · Unknown · Cloud Foundry

Name of the Vulnerable Software and Affected Versions: Cloud Foundry routing release versions from v0.163.0 to v0.283.0 Description: The issue allows an unauthenticated attacker to force route pruning, which can degrade the service availability of the Cloud Foundry deployment. This is achieved...

PT-2023-24652 · Cloud Foundry · Cloud Foundry Routing

Name of the Vulnerable Software and Affected Versions: Cloud Foundry Routing versions prior to 0.278.0 Description: The issue allows an unauthenticated attacker to abuse HTTP Hop-by-Hop Headers, affecting the identification value recorded in logs. Specifically, headers like B3 or X-B3-SpanID can ...

CVE-2023-20882: Uncontrolled Resource Consumption

In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected...

CVE-2020-5420

Cloud Foundry Routing Gorouter versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters...

CVE-2020-5420 Gorouter is vulnerable to DoS attack via invalid HTTP responses

Cloud Foundry Routing Gorouter versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters...

CVE-2020-5420: Improper Check for Unusual or Exceptional Conditions

Cloud Foundry Routing Gorouter versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters...

PT-2020-18472

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing Gorouter versions prior to 0.206.0 Description The issue allows a malicious developer with "cf push" access to cause denial-of-service to the Cloud Foundry cluster. This can be achieved by pushing an app that returns...

PT-2020-18468

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing Gorouter versions prior to 0.204.0 Description The issue allows an unauthenticated malicious attacker to send specially-crafted HTTP requests, potentially causing the Gorouters to be dropped from the NGINX backend pool,...

CVE-2020-5416: Improper Resource Shutdown or Release

Cloud Foundry Routing Gorouter, versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause...

Null pointer dereference

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

CVE-2020-5401

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

CVE-2020-5401: Return of Wrong Status Code

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

PT-2020-18457

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing Release versions prior to 0.197.0 Description The issue allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app. This is a cache poisoning...

CVE-2019-11289

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash...

CVE-2019-11289: Improper Input Validation

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash...

PT-2019-12231

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing versions prior to 0.193.0 Description The issue arises from improper input validation, allowing a maliciously crafted input to cause a panic due to incorrect nonce size. This can be used as a vector for a denial of servic...