CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2021-32783

Contour (Kubernetes ingress controller) before v1.17.1 is vulnerable to an ExternalName Service misconfiguration that permits access to Envoy’s admin interface from outside the Envoy container. This can enable remote shutdown or draining of Envoy and disclosure of secret metadata used by Envoy, t...

CVE-2024-36539

In Contour 1.28.3, insecure permissions on the service account allow attackers to access the token and escalate privileges, enabling sensitive data access. Affects Contour (Kubernetes ingress controller) v1.28.3; root cause is improper token permissions. Documented impact: high confidentiality, i...

CVE-2020-15127

Contour (Ingress controller for Kubernetes) prior to version 1.7.0 is affected by a DoS that lets a network attacker shut down all Envoy instances. The vulnerability arises from an unauthenticated /shutdown endpoint on port 8090 of the Envoy pod, which triggers Envoy shutdown and flips the readin...

CVE-2026-41246

Contour’s Cookie Rewriting feature (Envoy Lua filter) is vulnerable to Lua code injection from v1.19.0 up to before v1.33.4, v1.32.5, and v1.31.6. An attacker with RBAC to create/modify HTTPProxy resources can inject values into spec.routes[].cookieRewritePolicies[].pathRewrite.value (or services...