https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:59:33 +0000 https://vulnerability.circl.lu/vuln/ghsa-m2v6-2jmh-4c68 <p><strong>Affected:</strong> Go: github.com/envoyproxy/gateway</p> <p>Vulnerability report without repro case. Repro case may be added later after harness is complete.</p> <p>**Preconditions (4):** - Tenant has SecurityPolicy + TCPRoute RBAC (baseline) - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted (the trigger) - No admission webhook blocks the shape</p> <p>**Description:**</p> <p>A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.</p> <p><strong>Affected:</strong> Go: github.com/envoyproxy/gateway</p> <p>Vulnerability report without repro case. Repro case may be added later after harness is complete.</p> <p>**Preconditions (4):** - Tenant has SecurityPolicy + TCPRoute RBAC (baseline) - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted (the trigger) - No admission webhook blocks the shape</p> <p>**Description:**</p> <p>A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.</p> https://vulnerability.circl.lu/vuln/ghsa-m2v6-2jmh-4c68