CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2021-32783

Contour (Kubernetes ingress controller) before v1.17.1 is vulnerable to an ExternalName Service misconfiguration that permits access to Envoy’s admin interface from outside the Envoy container. This can enable remote shutdown or draining of Envoy and disclosure of secret metadata used by Envoy, t...

CVE-2026-41246

Contour’s Cookie Rewriting feature (Envoy Lua filter) is vulnerable to Lua code injection from v1.19.0 up to before v1.33.4, v1.32.5, and v1.31.6. An attacker with RBAC to create/modify HTTPProxy resources can inject values into spec.routes[].cookieRewritePolicies[].pathRewrite.value (or services...

CVE-2024-36539

In Contour v1.28.3 , insecure permissions allow attackers to access sensitive data and escalate privileges by obtaining a service account's token . The root cause is identified as insecure inherited permissions (CWE-277). Exploitation of this flaw can lead to unauthorized access to the Kubernetes...

CVE-2020-15127

Contour (Ingress controller for Kubernetes) prior to version 1.7.0 is affected by a DoS that lets a network attacker shut down all Envoy instances. The vulnerability arises from an unauthenticated /shutdown endpoint on port 8090 of the Envoy pod, which triggers Envoy shutdown and flips the readin...