https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:14:32 +0000 https://vulnerability.circl.lu/vuln/bit-envoy-2026-50572 <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy&#39;s HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy&#39;s HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> https://vulnerability.circl.lu/vuln/bit-envoy-2026-50572 https://vulnerability.circl.lu/vuln/fkie_cve-2026-50572 <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy&#39;s HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> <p>Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy&#39;s HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-50572 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11630-1 <p>istioctl-1.30.4-1.1 on GA media</p> <p>istioctl-1.30.4-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11630-1 https://vulnerability.circl.lu/vuln/rhsa-2026:65106 <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls envoy: envoy: ext_authz use-after-free after rejecting an HTTP request net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages envoy: envoy: path matching bypass via per-segment parameters not stripped by router envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free envoy: envoy: stored XSS through dynamically generated stat names in admin interface envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values e…</p> <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls envoy: envoy: ext_authz use-after-free after rejecting an HTTP request net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages envoy: envoy: path matching bypass via per-segment parameters not stripped by router envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free envoy: envoy: stored XSS through dynamically generated stat names in admin interface envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values e…</p> https://vulnerability.circl.lu/vuln/rhsa-2026:65106