CVE-2025-24030 Envoy Admin Interface Exposed through prometheus metrics endpoint

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...

CVE-2025-24030

CVE-2025-24030 affects Envoy Gateway prior to version 1.2.6. A user with Kubernetes cluster access can perform a path traversal attack against the Envoy Admin interface to terminate the Envoy process and exfiltrate the proxy configuration (potentially containing confidential data). The issue is f...

CVE-2025-24030 Envoy Admin Interface Exposed through prometheus metrics endpoint

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...

CVE-2025-24030 Envoy Admin Interface Exposed through prometheus metrics endpoint

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...

Envoy Gateway 安全漏洞

Envoy Gateway is an Envoy Proxy open source that uses Envoy agents as gateways for standalone or Kubernetes-based applications. A security vulnerability exists in Envoy Gateway versions prior to 1.2.6, which stems from the presence of a path traversal vulnerability that allows a user to execute...

PT-2025-5269

Name of the Vulnerable Software and Affected Versions: Envoy Gateway versions prior to 1.2.6 Description: A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by Envoy Gateway. The admin interface can be used to...

WordPress Push Envoy Notifications plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin Push Envoy Notifications versions = 1.0.0...

The vulnerability in the envoy.load_shed_points.http1_server_abort_dispatch configuration of the proxy server allows a hacker to trigger a service failure.

The vulnerability of the envoy.loadshedpoints.http1serverabortdispatch configuration on the proxy server is related to incorrect implementation of control flow management. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the Happy Eyeballs sorting algorithm for Envoy proxy servers allows a hacker to trigger a service denial.

The vulnerability of the Happy Eyeballs sorting algorithm for the Envoy proxy server is related to the incorrect implementation of the control flow when processing IP addresses. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the envoy.reloadable_features configuration. http1_balsa_delay_reset proxy server Envoy, which allows a hacker to trigger a service failure.

The vulnerability of the envoy.reloadablefeatures configuration, including http1balsadelay and reset, related to incorrect implementation of control flow processing when handling HTTP responses. Exploiting this vulnerability can allow an attacker to cause service interruptions...

SUSE CVE-2024-53269

Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to...

SUSE CVE-2024-53270

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called. However, the...

SUSE CVE-2024-53271

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to...

BIT-ENVOY-2024-53269 Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to...

BIT-ENVOY-2024-53270 HTTP/1: sending overload crashes when the request is reset beforehand in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl is called. However, the...

BIT-ENVOY-2024-53271 HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to...

CVE-2024-53270

A flaw was found in Envoy. In systems where http1serverabortdispatch is configured, Envoy does not properly handle the control flow during H1 stream resets. This can trigger a null pointer error and lead to an application crash. Mitigation Mitigation for this issue is either not available or the...

CVE-2024-53269

A flaw was found in Envoy. If the cluster configuration file contains malformed IP addresses, the Happy Eyeballs sorting algorithm may fail and trigger an application crash, leading to a denial of service...

CVE-2024-53271

A flaw was found in Envoy. In affected versions, Envoy does not properly handle certain HTTP 1.1 responses. Specially-crafted requests may trigger failures or application crashes in networked devices, leading to a denial of service...

CVE-2024-53271

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to...