TI-2026-36918 CVE-2026-50149 · GHSA-g3xr-5w5j-w4q4
Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
Priority LOW 28
Contour is a Kubernetes ingress controller using Envoy proxy.
Vulnerabilities
6 records
TI-2026-29855 CVE-2026-41246 · GHSA-x4mj-7f9g-29h4
Contour: Lua code injection via Cookie Path Rewrite Policy
Priority LOW 36
Contour is a Kubernetes ingress controller using Envoy proxy.
TI-2024-24308 CVE-2024-36539 · GHSA-6xhf-2fjj-wq6j
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and…
Priority HIGH 82
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3
The HTTP/2 protocol allows a denial of service (server resource consumption) because…
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
TI-2021-12450 CVE-2021-32783 · GHSA-5ph6-qq5x-7jwc
Authorization bypass in Contour
Priority LOW 39
Contour is a Kubernetes ingress controller using Envoy proxy.
TI-2020-11900 CVE-2020-15127
Denial of service in Contour
Priority LOW 36
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane.