CVE-2026-26308

Envoy CVE-2026-26308 affects the Envoy RBAC filter. The issue arises from how multiple HTTP header values are validated: instead of validating each value separately, Envoy concatenates all values into a single comma-separated string, allowing bypass of Deny rules under RBAC. Affects versions prio...

CVE-2026-26311

CVE-2026-26311 affects Envoy releases prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13. The issue is a logic vulnerability in the HTTP connection manager (FilterManager) where, after an HTTP/2 stream reset, the code may invoke filter callbacks on a stream that is already logically cleaned up, creatin...