EUVD-2025-7667

Malicious code in bioql PyPI...

EUVD-2025-0174

Malicious code in bioql PyPI...

BIT-ENVOY-GATEWAY-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

BIT-ENVOY-GATEWAY-2025-24030 Envoy Admin Interface Exposed through prometheus metrics endpoint

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...

GHSA-FV92-FJC5-JJ9H vulnerabilities

Vulnerabilities for packages: dive, policy-controller, gcsfuse, calico-fips, nerdctl-fips, pgtimetable-fips, swagger, nri-kubernetes, argo-events-fips, spire-server, docker-compose, cloud-sql-proxy-fips, agentbeat, trivy-operator, opa-envoy, falcoctl-fips, spark-operator-fips, argo-workflows-fips...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: chartmuseum, trivy, envoy-gateway, dagger, nerdctl, cluster-api-helm-controller, fuse-overlayfs-snapshotter, rancher-fleet, kargo, wolfictl, k3s, helm-operator, skaffold, eksctl, docker, flux-source-controller, opa-envoy, neuvector-scanner, buildkitd, opa,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: grype-fips, envoy-gateway, nerdctl, kargo, rancher-fleet, wolfictl, docker-compose, buildkitd-fips, cilium-cli, grype, eksctl, docker-cli-buildx-fips, buildkitd, envoy-gateway-fips, flux-source-controller, kots, opa-envoy, helm-operator, cluster-api-helm-controller,...

CVE-2024-40635 vulnerabilities

Vulnerabilities for packages: grype-fips, envoy-gateway, nerdctl, kargo, rancher-fleet, wolfictl, docker-compose, buildkitd-fips, cilium-cli, grype, eksctl, docker-cli-buildx-fips, buildkitd, envoy-gateway-fips, flux-source-controller, kots, opa-envoy, helm-operator, cluster-api-helm-controller,...

SUSE CVE-2025-25294

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

Log Injection

Envoy Gateway is vulnerable to Log Injection. The vulnerability is due to improper log handling due to the use of a default Envoy Proxy access log configuration, allowing attackers to craft user-agent strings that inject and overwrite fields in the access log...

GO-2025-3504 Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway

Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway...

CVE-2025-25294

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

Envoy Gateway Log Injection Vulnerability

Impact In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to th...

GHSA-MF24-CHXH-HMVJ Envoy Gateway Log Injection Vulnerability

Impact In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to th...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

CVE-2025-25294

Envoy Gateway has a log injection vulnerability in its default Envoy Proxy access log configuration on affected releases prior to 1.2.7 and 1.3.1. A crafted user-agent could trigger JSON injection, allowing modification of the access log. The issue is fixed in 1.2.7 and 1.3.1 by updating EnvoyPro...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

Linux Distros Unpatched Vulnerability : CVE-2025-24030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes...

PT-2025-9996

Name of the Vulnerable Software and Affected Versions: Envoy Gateway versions prior to 1.2.7 Envoy Gateway versions prior to 1.3.1 Description: The issue concerns a default Envoy Proxy access log configuration that is vulnerable to log injection attacks. An attacker can use a specially crafted...