Action not permitted
Modal body text goes here.
Modal Title
Modal Body
Vulnerability from cleanstart
Published
2026-09-01 11:17
Modified
2026-09-04 11:14
Summary
Security fixes in tigera-operator-fips 1.38.16-r1
Details
Package tigera-operator-fips version 1.38.16-r1 fixes 7 vulnerabilities: CVE-2026-53713, CVE-2026-53714, CVE-2026-53715, CVE-2026-53716, CVE-2026-53717...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "tigera-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.38.16-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.38.16-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package tigera-operator-fips version 1.38.16-r1 fixes 7 vulnerabilities: CVE-2026-53713, CVE-2026-53714, CVE-2026-53715, CVE-2026-53716, CVE-2026-53717...",
"id": "CLEANSTART-2026-ZE35909",
"modified": "2026-09-04T11:14:10Z",
"published": "2026-09-01T11:17:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tigera/operator"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in tigera-operator-fips 1.38.16-r1",
"upstream": [
"CVE-2026-53713",
"CVE-2026-53714",
"CVE-2026-53715",
"CVE-2026-53716",
"CVE-2026-53717",
"CVE-2026-53718",
"CVE-2026-53719"
]
}
CVE-2026-53713 (GCVE-0-2026-53713)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:11 – Updated: 2026-09-14 20:11
VLAI
EPSS
VEX
Title
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1.
Severity
9.1 (Critical)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/gateway/security/ad… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/gateway/pull/9171 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9172 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9173 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/5a78… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/96e2… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/b473… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | gateway |
Affected:
< 1.7.4
Affected: >= 1.8.0-rc.0, < 1.8.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "gateway",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.4"
},
{
"status": "affected",
"version": "\u003e= 1.8.0-rc.0, \u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-slash absolute path as the corresponding single-slash path, but the validator does not match the redundant-separator form, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data, and the disclosed credentials can provide access to sensitive Kubernetes API Server or Gateway xDS server information. This issue is fixed in versions 1.7.4 and 1.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:11:02.561Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9171"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9172",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9172"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9173"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"
}
],
"source": {
"advisory": "GHSA-wcrf-9vrr-854f",
"discovery": "UNKNOWN"
},
"title": "Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53713",
"datePublished": "2026-09-14T20:11:02.561Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-09-14T20:11:02.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53714 (GCVE-0-2026-53714)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:17 – Updated: 2026-09-14 20:17
VLAI
EPSS
VEX
Title
Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by the State-of-the-World protocol fails the type assertion and returns success without JWT validation. Any pod that can reach port 18000 can use the unauthenticated unary or State-of-the-World paths to retrieve TLS private keys through StreamSecrets, all xDS resources through StreamAggregatedResources, backend endpoints through StreamClusters or StreamEndpoints, and routing configuration through StreamRoutes or StreamListeners. This issue is fixed in versions 1.7.4 and 1.8.1.
Severity
7.4 (High)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/gateway/security/ad… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/gateway/pull/8986 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9116 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9118 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/4df0… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/e912… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/f1f9… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | gateway |
Affected:
< 1.7.4
Affected: >= 1.8.0-rc.0, < 1.8.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "gateway",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.4"
},
{
"status": "affected",
"version": "\u003e= 1.8.0-rc.0, \u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by the State-of-the-World protocol fails the type assertion and returns success without JWT validation. Any pod that can reach port 18000 can use the unauthenticated unary or State-of-the-World paths to retrieve TLS private keys through StreamSecrets, all xDS resources through StreamAggregatedResources, backend endpoints through StreamClusters or StreamEndpoints, and routing configuration through StreamRoutes or StreamListeners. This issue is fixed in versions 1.7.4 and 1.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:17:22.256Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/8986",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/8986"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9116",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9116"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9118",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9118"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/4df0809ff1ed59ffb09604da4084335b8c6647c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/4df0809ff1ed59ffb09604da4084335b8c6647c5"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/e9124abc4ff4b63a218a6890c1b28a982c850465",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/e9124abc4ff4b63a218a6890c1b28a982c850465"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/f1f9829af2a231f0cae915c09800353c76622d97",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/f1f9829af2a231f0cae915c09800353c76622d97"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"
}
],
"source": {
"advisory": "GHSA-22xc-xg2r-9j7v",
"discovery": "UNKNOWN"
},
"title": "Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53714",
"datePublished": "2026-09-14T20:17:22.256Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-09-14T20:17:22.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53715 (GCVE-0-2026-53715)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:14 – Updated: 2026-09-14 20:14
VLAI
EPSS
VEX
Title
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.
Severity
5.3 (Medium)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/gateway/security/ad… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/gateway/pull/9171 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9172 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9173 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/5a78… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/96e2… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/b473… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | gateway |
Affected:
< 1.7.4
Affected: >= 1.8.0-rc.0, < 1.8.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "gateway",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.4"
},
{
"status": "affected",
"version": "\u003e= 1.8.0-rc.0, \u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go\u0027s concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:14:34.223Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-8fv2-88gg-hm7q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-8fv2-88gg-hm7q"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9171"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9172",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9172"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9173"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"
}
],
"source": {
"advisory": "GHSA-8fv2-88gg-hm7q",
"discovery": "UNKNOWN"
},
"title": "Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53715",
"datePublished": "2026-09-14T20:14:34.223Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-09-14T20:14:34.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53716 (GCVE-0-2026-53716)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:15 – Updated: 2026-09-14 20:15
VLAI
EPSS
VEX
Title
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1.
Severity
6.5 (Medium)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/gateway/security/ad… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/gateway/pull/9171 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9172 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9173 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/5a78… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/96e2… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/b473… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | gateway |
Affected:
< 1.7.4
Affected: >= 1.8.0-rc.0, < 1.8.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "gateway",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.4"
},
{
"status": "affected",
"version": "\u003e= 1.8.0-rc.0, \u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:15:51.441Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9171"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9172",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9172"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9173"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"
}
],
"source": {
"advisory": "GHSA-cxpq-8v7q-cg56",
"discovery": "UNKNOWN"
},
"title": "Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53716",
"datePublished": "2026-09-14T20:15:51.441Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-09-14T20:15:51.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53717 (GCVE-0-2026-53717)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:09 – Updated: 2026-09-14 20:09
VLAI
EPSS
VEX
Title
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers, and extractWasmPluginBinary uses the untrusted tar-header h.Size value to allocate memory before validating the entry name or declared size. A small PAX or GNU tar header can therefore claim a multi-terabyte entry even though the surrounding LimitReader restricts only the bytes read from the stream, and no registry allowlist prevents a permitted tenant from selecting an attacker-controlled registry that the controller can reach. The allocation is attempted for every tar entry and can cause an unrecoverable Go runtime out-of-memory failure; because the custom resource persists, reconciliation repeatedly crash-loops the shared controller and causes a single-request, non-volumetric, cluster-wide control-plane denial of service. This issue is fixed in versions 1.7.4 and 1.8.1.
Severity
6.5 (Medium)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/gateway/security/ad… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/gateway/pull/9171 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9172 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9173 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/5a78… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/96e2… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/b473… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | gateway |
Affected:
< 1.7.4
Affected: >= 1.8.0-rc.0, < 1.8.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "gateway",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.4"
},
{
"status": "affected",
"version": "\u003e= 1.8.0-rc.0, \u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers, and extractWasmPluginBinary uses the untrusted tar-header h.Size value to allocate memory before validating the entry name or declared size. A small PAX or GNU tar header can therefore claim a multi-terabyte entry even though the surrounding LimitReader restricts only the bytes read from the stream, and no registry allowlist prevents a permitted tenant from selecting an attacker-controlled registry that the controller can reach. The allocation is attempted for every tar entry and can cause an unrecoverable Go runtime out-of-memory failure; because the custom resource persists, reconciliation repeatedly crash-loops the shared controller and causes a single-request, non-volumetric, cluster-wide control-plane denial of service. This issue is fixed in versions 1.7.4 and 1.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:09:44.990Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9171"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9172",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9172"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9173"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"
}
],
"source": {
"advisory": "GHSA-h7pq-86h8-rp5x",
"discovery": "UNKNOWN"
},
"title": "Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53717",
"datePublished": "2026-09-14T20:09:44.990Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-09-14T20:09:44.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53718 (GCVE-0-2026-53718)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:12 – Updated: 2026-09-14 20:12
VLAI
EPSS
VEX
Title
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1.
Severity
6.4 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/gateway/security/ad… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/gateway/pull/9171 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9172 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9173 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/5a78… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/96e2… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/b473… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | gateway |
Affected:
< 1.7.4
Affected: >= 1.8.0-rc.0, < 1.8.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "gateway",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.4"
},
{
"status": "affected",
"version": "\u003e= 1.8.0-rc.0, \u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner\u0027s consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:12:12.224Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9171"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9172",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9172"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9173"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"
}
],
"source": {
"advisory": "GHSA-fcrp-7gc2-93g7",
"discovery": "UNKNOWN"
},
"title": "Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53718",
"datePublished": "2026-09-14T20:12:12.224Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-09-14T20:12:12.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53719 (GCVE-0-2026-53719)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:13 – Updated: 2026-09-14 20:13
VLAI
EPSS
VEX
Title
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1.
Severity
6.5 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/gateway/security/ad… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/gateway/pull/9171 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9172 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/pull/9173 | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/5a78… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/96e2… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/commit/b473… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
| https://github.com/envoyproxy/gateway/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | gateway |
Affected:
< 1.7.4
Affected: >= 1.8.0-rc.0, < 1.8.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "gateway",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.4"
},
{
"status": "affected",
"version": "\u003e= 1.8.0-rc.0, \u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value when a namespace-scoped tenant creates a SecurityPolicy targeting a TCPRoute and omits spec.authorization. The persistent object triggers the panic on every reconcile; recovery in message/watchutil.go keeps the process alive but unwinds the runner/runner.go handle callback, stalling controller-wide xDS and infrastructure intermediate-representation publishing until an administrator deletes the object. The data plane continues to serve the last known good configuration while publication is stalled. This issue is fixed in versions 1.7.4 and 1.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:13:20.535Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9171"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9172",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9172"
},
{
"name": "https://github.com/envoyproxy/gateway/pull/9173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/pull/9173"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
},
{
"name": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4"
},
{
"name": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1"
}
],
"source": {
"advisory": "GHSA-m2v6-2jmh-4c68",
"discovery": "UNKNOWN"
},
"title": "Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53719",
"datePublished": "2026-09-14T20:13:20.535Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-09-14T20:13:20.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…