Skip to content
OpenAdvisories

Package · Go

github.com/projectcontour/contour

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.5
    CVE-2026-50149

    Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

    Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virtualhost.jwtProvider…

    projectcontour contour github.com/projectcontour/contour Go
  • High 8.1
    CVE-2026-41246

    Contour: Lua code injection via Cookie Path Rewrite Policy

    Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPProxy resourc…

    projectcontour contour github.com/projectcontour/contour Go
  • High 8.5
    CVE-2021-32783

    Authorization bypass in Contour

    Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container…

    projectcontour contour github.com/projectcontour/contour Go