https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-12T08:47:55.260781+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cleanstart-2026-yr40466 Withdrawn: CLEANSTART-2026-YR40466 — Security fixes in tigera-operator 1.39.3-r1 2026-10-12T08:47:55.419695+00:00

Withdrawn by the publisher.

Affected: CleanStart: tigera-operator

Package tigera-operator version 1.39.3-r1 fixes 17 vulnerabilities: CVE-2026-53713, CVE-2026-53714, CVE-2026-53715, CVE-2026-53716, CVE-2026-53717...

 https://vulnerability.circl.lu/vuln/cve-2026-53715 CVE-2026-53715 — Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock 2026-10-12T08:47:55.419795+00:00

Affected: envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.