45 results · Clear filters · Feed
-
High 8.6
Continued processing of requests after locally generated response
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when loca…
-
High 8.6
Incorrectly handling of URI '#fragment' element as part of the path element
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for …
-
High 8.6
Incorrect concatenation of multiple value request headers in ext-authz extension
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value header…
-
High 8.1CVE-2021-29492 EPSS 63%
Bypass of path matching rules using escaped slash characters
Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypas…
-
High 8.2
JWT authentication bypass with unknown issuer token
Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured wi…