CVE-2025-25294

Envoy Gateway has a log injection vulnerability in its default Envoy Proxy access log configuration on affected releases prior to 1.2.7 and 1.3.1. A crafted user-agent could trigger JSON injection, allowing modification of the access log. The issue is fixed in 1.2.7 and 1.3.1 by updating EnvoyPro...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

Linux Distros Unpatched Vulnerability : CVE-2025-24030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes...

Envoy Gateway 安全漏洞

Envoy Gateway is an Envoy Proxy open source that uses the Envoy proxy as a gateway for standalone or Kubernetes-based applications. A security vulnerability exists in Envoy Gateway versions prior to 1.2.7 and 1.3.1 that stems from the default Envoy Proxy access logging configuration being...

PT-2025-9996

Name of the Vulnerable Software and Affected Versions: Envoy Gateway versions prior to 1.2.7 Envoy Gateway versions prior to 1.3.1 Description: The issue concerns a default Envoy Proxy access log configuration that is vulnerable to log injection attacks. An attacker can use a specially crafted...

CVE-2025-23556

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in netbitsolutions Push Envoy Notifications push-envoy allows Reflected XSS.This issue affects Push Envoy Notifications: from n/a through = 1.0.0...

CVE-2025-23556 WordPress Push Envoy Notifications plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in netbitsolutions Push Envoy Notifications push-envoy allows Reflected XSS.This issue affects Push Envoy Notifications: from n/a through = 1.0.0...

CVE-2025-23556

CVE-2025-23556 concerns a reflected Cross-Site Scripting (XSS) in the WordPress Push Envoy Notifications plugin

WordPress plugin Push Envoy Notifications 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2025-850)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-850 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2025-047)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.12.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-047 advisory. Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: paranoia, k8sgpt-operator, grafana-operator, k8sgpt, gitness, dockerize, kyverno-policy-reporter, vite, pulumi-kubernetes-operator, grpcurl, oras, k3s, spark-operator, esbuild, task, tailscale, wireguard-go, govulncheck, kind, dynamic-localpv-provisioner,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: paranoia, k8sgpt-operator, grafana-operator, k8sgpt, gitness, dockerize, kyverno-policy-reporter, vite, pulumi-kubernetes-operator, grpcurl, oras, k3s, spark-operator, esbuild, task, tailscale, wireguard-go, govulncheck, kind, dynamic-localpv-provisioner,...

Important: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called...

Important: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called...

[R1] Tenable Identity Exposure Version 3.77.9 Fixes Multiple Vulnerabilities

R1 Tenable Identity Exposure Version 3.77.9 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 02/20/2025 - 12:00 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components node.js, Envoy, curl were found to contain...

CVE-2021-39206

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect...

CVE-2021-39162

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...

CVE-2020-15127

In Contour Ingress controller for Kubernetes before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes...