CVE-2023-33869-RCE-PoC

エネルギーセキュリティ・信頼性センター - UNCシャーロット校 CVE-2023-33869 は、Enphase Envoy ファームウェア バージョン D7.0.88 に影響を与えるコマンドインジェクションの脆弱性です。この脆弱性により、攻撃者は影響を受けるデバイス上でルート権限を持つ任意のコマンドを注入し、実行することができます。Enphase Envoy は、住宅用および商業用の太陽エネルギーシステムで広く導入されている太陽光マイクロインバーターゲートウェイデバイスであり、この脆弱性は重要インフラや IoT 環境にとって特に懸念されます。...

Envoy-CPU-Exhaustion-Vulnerability-PoC

Envoy CPU 枯渇脆弱性 PoC このリポジトリには、CONTINUATIONフレームのフラッドによって引き起こされるEnvoyのCPU枯渇脆弱性を実証するための概念実証（PoC）Pythonスクリプトが含まれています。著者: blackmagic 2024 説明...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...

SUSE CVE-2022-29224

Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can "hold" prevent removal upstrea...

CVE-2026-53716

A flaw was found in Envoy Gateway. A remote attacker, by providing a specially crafted compressed WebAssembly Wasm payload through a tenant-controlled URL, can exploit a vulnerability where the system decompresses the gzip file without limiting the output size. This can lead to an uncontrolled...

CVE-2026-53715

A flaw was found in Envoy Gateway. Improper synchronization in the Wasm cache handling allows an attacker with pod-network access and tenant permissions to trigger a race condition. By flooding GET requests, an attacker can cause a read-write overlap, leading to the termination of the controller...

CVE-2026-49975-HTTP-2-Bomb

CVE-2026-49975 —「HTTP/2 Bomb」にさらされた攻撃対象領域を特定するためのトリアージ （悪用ではない）ツールです。 ⚠️ このスクリプトは攻撃ペイロードを送信しません 。通常のHTTPリクエストのみを行い、レスポンスヘッダーを分析して、手動でのバージョン/パッチ確認が必要なホストをフラグ付けします。 CVE-2026-49975 について 2026年6月3日に公開された「HTTP/2 Bomb」は、HPACK圧縮爆弾とSlowlorisスタイルのホールドを組み合わせた未認証のリモートDoSであり、デフォルトのHTTP/2設定でnginx、Apache...

CVE-2026-53718

A flaw was found in Envoy Gateway. An attacker could exploit a vulnerability in how HTTPRoute handles custom backend references. This allows a route-owning namespace to access and utilize resources in another namespace without proper authorization, bypassing the intended Gateway API cross-namespa...

BIT-ENVOY-2026-73553 Envoy: RBAC Authorization Bypass via Path Parameters

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

BIT-ENVOY-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

BIT-ENVOY-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

BIT-ENVOY-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

BIT-ENVOY-2026-73549 Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string...

BIT-ENVOY-2026-73548 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...

BIT-ENVOY-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

BIT-ENVOY-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

BIT-ENVOY-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...

BIT-ENVOY-2026-73512 Envoy: use-after-free in QUIC on internal redirects

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the...

BIT-ENVOY-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

BIT-ENVOY-2026-50572 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the...