CVE-2025-55162 Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. Whe...

CVE-2025-55162 Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. Whe...

Envoy 资源管理错误漏洞

Envoy is an Enphase open source gateway program for connecting smart home devices. A resource management error vulnerability exists in Envoy versions 1.34.0 through 1.34.4 and 1.35.0, which stems from the presence of post-release reuse in the DNS cache and could result in an abnormal process...

Envoy 代码问题漏洞

Envoy is an Enphase open source gateway program for connecting smart home devices. A code issue vulnerability exists in Envoy, which stems from the OAuth2 filter omitting the Secure attribute when deleting session cookies with the Secure-/Host- prefix, resulting in the browser rejecting the delet...

PT-2025-35711

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.32.10 Envoy versions 1.33.0 through 1.33.6 Envoy versions 1.34.0 through 1.34.4 Envoy versions 1.35.0 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented...

CVE-2025-54588 Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free UAF vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic...

Linux Distros Unpatched Vulnerability : CVE-2023-2816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy...

MAL-2025-35618 Malicious code in test-mlw2-kiley-envoy-zests-clype (npm)

The package test-mlw2-kiley-envoy-zests-clype was found to contain malicious code...

Malicious code in test-mlw2-kiley-envoy-zests-clype (npm)

The package test-mlw2-kiley-envoy-zests-clype was found to contain malicious code...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose-fips, terraform-provider-kubernetes, eck-operator, nri-mssql, cluster-api-helm-controller, rke2-cloud-provider, spicedb, kubernetes-dashboard-api, kubo-fips, timestamp-authority-fips, flux-image-reflector-controller-fips, rancher-agent,...

Linux Distros Unpatched Vulnerability : CVE-2025-22021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: socket: Lookup orig tuple for IPv6 SNAT nfsklookupslowv4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, ...

GHSA-FV92-FJC5-JJ9H vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, calico-fips, opentelemetry-operator, tekton-chains, spire-server-fips, timestamp-authority-fips, aws-otel-collector-fips, opa-envoy, terraform-provider-acme, goreleaser, kyverno-notation-aws-fips, docker-compose, nri-kubernetes,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT The nfsklookupslowv4 function performs the conntrack lookup for IPv4 packets in order to restore the original 5-tuple in case of SNAT, so that the correct socket if any can be...

CVE-2025-4673 vulnerabilities

Vulnerabilities for packages: ctop, kubernetes-release, logstash-exporter, fscrypt, docker-machine-driver-harvester, oras, spiffe-helper, witness, git-lfs, kubernetes-dashboard-api, doppler-kubernetes-operator, postgres-operator, newrelic-fluent-bit-output, azure-service-operator, nri-prometheus,...

CVE-2024-28249

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sen...

CVE-2023-33869

Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands...

CVE-2023-2816

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the services corresponding to those...

CVE-2021-32783

Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2020-25754

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an...