CVE-2024-23326 Envoy incorrectly accepts HTTP 200 response for entering upgrade mode

Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230section-6.7 a server sends 101 when switching...

SUSE CVE-2021-32778

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy's procedure for resetting a HTTP/2 stream has ON^2 complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are...

SUSE CVE-2023-35945

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

SUSE CVE-2022-29227

Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there's a lifetime bug which can be triggered. If while replaying the request Envoy sends a local...

SUSE CVE-2022-29228

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT in newer versions and corrupts memory on earlier versions. continueDecoding shouldn't ever ...

The vulnerability of the Envoy proxy server, related to improper checking of the error value of the pointer, allows a hacker to cause an unexpected termination of the application.

The vulnerability of the Envoy proxy server is related to improper checking of the error value of the pointer. Exploiting this vulnerability can allow a malicious actor to cause an unexpected termination of the application...

The vulnerability of the Envoy proxy server, which stems from uncontrolled resource consumption, allows attackers to cause service interruptions.

The vulnerability of the Envoy proxy server exists due to uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures...

ROS-20240423-06

Envoy proxy vulnerability is due to the fact that regular expressions are compiled for each request and can lead to high CPU utilization and increased request latency. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service. The Envoy proxy...

The vulnerability of the Envoy proxy server, related to pointer dereferencing errors, allows a hacker to cause a service failure.

The vulnerability of the Envoy proxy server is related to pointer arithmetic errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the Envoy proxy server arises from insufficient validation of input data, allowing attackers to bypass the authentication process.

The vulnerability of the Envoy proxy server exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass the authentication process...

The vulnerability of the Envoy proxy server, related to the use of memory after it is freed, allows a hacker to cause an unexpected termination of the application.

The vulnerability of the Envoy proxy server is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause an unexpected termination of the application...

The vulnerability of the Envoy proxy server, related to an unintercepted exception, allows a malicious actor to trigger an emergency termination of the application.

The vulnerability of the Envoy proxy server is related to an unintercepted exception. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause an unexpected termination of the application...

The vulnerability of the nghttp2 codec in the Envoy proxy server allows a attacker to cause a service failure.

The vulnerability of the nghttp2 codec in the Envoy proxy server relates to the implementation of the HTTP/2 protocol. It involves sending an unlimited number of CONTINUATION requests when the maximum header size limit is exceeded, due to the absence of the ENDHEADERS flag. Exploiting this...

The vulnerability of the oghttp-codec in the Envoy proxy server allows a hacker to trigger a service failure.

The vulnerability of the oghttp-codec in the implementation of the HTTP/2 protocol in the Envoy proxy is related to an error during request submission when exceeding the header size limit. This occurs due to the absence of the ENDHEADERS flag during the processing of CONTINUATION messages...

CVE-2024-30255

A vulnerability was found in how Envoy Proxy implements the HTTP/2 codec. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which...

CVE-2024-27919

A vulnerability was found in how Envoy Proxy implements the oghttp codec. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which...

GO-2024-2656 Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted, and traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent...

CVE-2024-28249

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sen...

CVE-2024-28249 Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sen...

Unencrypted traffic between nodes when using WireGuard and L7 policies

Impact In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies: - Traffic that should be WireGuard-encrypted is sent unencrypted between a node's Envoy proxy and pods on other nodes. - Traffic that should be WireGuard-encrypted is sent unencrypted between a node's DNS prox...