https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:14:06 +0000 https://vulnerability.circl.lu/vuln/ghsa-8fv2-88gg-hm7q <p><strong>Affected:</strong> Go: github.com/envoyproxy/gateway</p> <p>Vulnerability report without repro case. Repro case may be added later after harness is complete.</p> <p>**Preconditions (4):** - Pod-network reachability to :18002 (no auth) - Tenant can create EnvoyExtensionPolicy (baseline) - Attacker pod floods GET while churning EnvoyExtensionPolicy with distinct Wasm URLs - Read at :153 must overlap a write at :201/:209 (probabilistic, attacker controls both rates)</p> <p>**Description:**</p> <p>httpserver.go:153 reads s.mappingPath2Cache with no lock while httpserver.go:201/209 write it under s.Lock(); the struct uses a plain map. Writer is tenant-reachable via EnvoyExtensionPolicy translation, reader is pod-network-reachable on :18002 with per-request goroutines. Go&#39;s concurrent map read+write detection calls runtime.throw, which net/http&#39;s per-conn recover cannot catch, so the controller process exits — cross-tenant control-plane DoS. Capped at MEDIUM: DoS-only, k8s restarts pod, timing-dependent trigger.</p> <p><strong>Affected:</strong> Go: github.com/envoyproxy/gateway</p> <p>Vulnerability report without repro case. Repro case may be added later after harness is complete.</p> <p>**Preconditions (4):** - Pod-network reachability to :18002 (no auth) - Tenant can create EnvoyExtensionPolicy (baseline) - Attacker pod floods GET while churning EnvoyExtensionPolicy with distinct Wasm URLs - Read at :153 must overlap a write at :201/:209 (probabilistic, attacker controls both rates)</p> <p>**Description:**</p> <p>httpserver.go:153 reads s.mappingPath2Cache with no lock while httpserver.go:201/209 write it under s.Lock(); the struct uses a plain map. Writer is tenant-reachable via EnvoyExtensionPolicy translation, reader is pod-network-reachable on :18002 with per-request goroutines. Go&#39;s concurrent map read+write detection calls runtime.throw, which net/http&#39;s per-conn recover cannot catch, so the controller process exits — cross-tenant control-plane DoS. Capped at MEDIUM: DoS-only, k8s restarts pod, timing-dependent trigger.</p> https://vulnerability.circl.lu/vuln/ghsa-8fv2-88gg-hm7q