Priority HIGH 72
Envoy is an open source edge and service proxy designed for cloud-native applications.
RHSA-2026:65115
Red Hat OpenShift Service Mesh 3.3.7
Released 2026-09-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
Fixes 18 records
TI-2026-51639 CVE-2026-73548
Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
Priority HIGH 72
Envoy is an open source edge and service proxy designed for cloud-native applications.
Priority HIGH 72
Envoy is an open source edge and service proxy designed for cloud-native applications.
Priority HIGH 68
Envoy is an open source edge and service proxy designed for cloud-native applications.
Priority HIGH 66
Envoy is an open source edge and service proxy designed for cloud-native applications.
TI-2026-51638 CVE-2026-73547
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
Priority MEDIUM 40
Envoy is an open source edge and service proxy designed for cloud-native applications.
TI-2026-40999 CVE-2026-56862 · GHSA-7qch-w8m5-g3h3
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Priority MEDIUM 40
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.
TI-2026-40997 CVE-2026-56859 · GHSA-76p8-fhrm-vpc7
Add recursion depth guard during decode in encoding/xml
Priority MEDIUM 40
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
TI-2026-40993 CVE-2026-56853 · GHSA-xphw-4f88-5f39
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Priority MEDIUM 40
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.
TI-2026-26189 CVE-2026-33818 · GHSA-xc2p-8ggw-6cr5
Enforce maximum recursion depth in encoding/asn1
Priority MEDIUM 40
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
TI-2026-51643 CVE-2026-73552
Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
Priority LOW 39
Envoy is an open source edge and service proxy designed for cloud-native applications.
TI-2026-51642 CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot segments with parameters
Priority LOW 31
Envoy is an open source edge and service proxy designed for cloud-native applications.
TI-2026-51620 CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with…
Priority LOW 30
Envoy is an open source edge and service proxy designed for cloud-native applications.
TI-2026-28707 CVE-2026-39825 · GHSA-h74g-238j-357m
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
Priority LOW 30
ReverseProxy can forward queries containing parameters not visible to Rewrite functions.
Priority LOW 28
Envoy is an open source edge and service proxy designed for cloud-native applications.
TI-2026-40998 CVE-2026-56860 · GHSA-25mv-j2qr-v5jq
Avoid quadratic complexity in resolvePath in net/url
Priority LOW 27
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
TI-2026-40996 CVE-2026-56858 · GHSA-c974-w86c-vpfw
Fix Javascript regexp context tracking in html/template
Priority LOW 27
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Priority LOW 25
Envoy is an open source edge and service proxy designed for cloud-native applications.