[{"uuid":"GSA_kwCzR0hTQS1jMjNjLXJwM20tdnBnM84ABTag","url":"https://github.com/advisories/GHSA-c23c-rp3m-vpg3","title":"Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly","description":"### Summary\n\nAt the rate limit filter, if we enabled the response phase limit with `apply_on_stream_done` in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy.\n\n### Details\n\nWhen both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request.\n\nBut after the request phase request is done, the inner state of the request phase limit request in gRPC client is not cleaned up. When we send the second limit request at response phase, and the second limit request fails directly, we may access the previous request's inner state and result in crash.\n\n\n### PoC\n\nThis need to mock the network failure. But we have reproduced by unit test locally.\n\n### Impact\n\nThis only happens when both the request phase limit and response phase limit are enabled in the rate limit filter, and requires the request to rate limit service fails directly (For example, if from Envoy's perspective, no healthy endpoint for rate limit service may result the request fails directly). That's say, not easy to trigger this.\n\n### To workaround\n\nThis could be worked around by splitting the rate limit filter. That is, if there is a rate limit filter that contains normal rate limit configuration (request phase limit, without `apply_on_stream_done`) and also rate limit configuration with `apply_on_stream_done` (response phase limit). Splitting them into two rate limit filters and ensure one filter only contains normal rate limit configuration (without `apply_on_stream_done`), and one only contains rate limit configuration with `apply_on_stream_done` could avoid this problem. \n\n### Credit\n\nMandar Jog (mandarjog@gmail.com)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-10T18:31:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-c23c-rp3m-vpg3","https://nvd.nist.gov/vuln/detail/CVE-2026-26330","https://github.com/advisories/GHSA-c23c-rp3m-vpg3"],"source_kind":"github","identifiers":["GHSA-c23c-rp3m-vpg3","CVE-2026-26330"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-10T19:00:07.665Z","updated_at":"2026-10-16T06:05:04.502Z","epss_percentage":0.00388,"epss_percentile":0.30755,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMjNjLXJwM20tdnBnM84ABTag","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jMjNjLXJwM20tdnBnM84ABTag","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.4"},{"first_patched_version":null,"vulnerable_version_range":"= 1.37.0"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jMjNjLXJwM20tdnBnM84ABTag/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04NHhtLXI0MzgtODZweM4ABTYC","url":"https://github.com/advisories/GHSA-84xm-r438-86px","title":"Envoy: HTTP - filter chain execution on reset streams causing UAF crash","description":"**Note:**\nThis vulnerability was originally reported to the Google OSS VRP (Issue ID: [477542544](https://issuetracker.google.com/issues/477542544)). The Google Security Team requested that I coordinate directly with the Envoy maintainers for triage and remediation. I am submitting this report here to facilitate that process.\n\n**Technical Details**\nI have identified a logic vulnerability in Envoy's HTTP connection manager (`FilterManager`) that allows for **Zombie Stream Filter Execution**. This issue creates a \"Use-After-Free\" (UAF) or state-corruption window where filter callbacks are invoked on an HTTP stream that has already been logically reset and cleaned up.\n\n**Mechanism:**\nThe vulnerability resides in `source/common/http/filter_manager.cc` within the `FilterManager::decodeData` method.\n\nWhen an HTTP/2 stream encounters a reset condition (e.g., `StreamIdleTimeout`, `OverloadManager` limits, or a local reset triggered by a filter), Envoy calls `onResetStream`. This method:\n1.  Sets the internal state `state_.saw_downstream_reset_ = true`.\n2.  Invokes `onDestroy()` on all filters in the chain (allowing them to release resources/pointers).\n3.  Schedules the `ActiveStream` object for **deferred deletion** (cleanup happens later in the event loop).\n\n**The Flaw:**\nThe `ActiveStream` object remains valid in memory during the deferred deletion window. If a `DATA` frame arrives on this stream immediately after the reset (e.g., in the same packet processing cycle), the HTTP/2 codec invokes `ActiveStream::decodeData`, which cascades to `FilterManager::decodeData`.\n\n`FilterManager::decodeData` **fails to check the `saw_downstream_reset_` flag**. It iterates over the `decoder_filters_` list and invokes `decodeData()` on filters that have already received `onDestroy()`.\n\n**Root Cause Code Location:**\nFile: `source/common/http/filter_manager.cc`\nFunction: `FilterManager::decodeData`\n\n```cpp\nvoid FilterManager::decodeData(...) {\n  if (stopDecoderFilterChain()) { return; }\n\n  // Vulnerability: Missing check for state_.saw_downstream_reset_\n  // Execution proceeds into the loop even if the stream is logically dead.\n\n  auto trailers_added_entry = decoder_filters_.end();\n  for (; entry != decoder_filters_.end(); entry++) {\n      // ... calls (*entry)-\u003ehandle_-\u003edecodeData(data) on destroyed filters ...\n  }\n}\n```\n\n**Suggested Fix:**\nAdd an explicit state check at the beginning of `FilterManager::decodeData`.\n\n```cpp\n// Prevent execution on streams that have been reset but not yet destroyed.\nif (state_.saw_downstream_reset_) {\n  return;\n}\n```\n\n---\n\n## Impact Analysis\n\n**Who can exploit this:**\nAny remote attacker capable of establishing an HTTP/2 or HTTP/3 connection. No privileges/authentication required.\n\n**Impact \u0026 Gain:**\n**1. Memory Corruption \u0026 Potential Remote Code Execution:**\nWhile the immediate symptom is a crash (DoS), the underlying primitive is a **Use-After-Free (CWE-416)**.\n* **Mechanism:** When `onDestroy()` is called on filters (e.g., Lua, Wasm, or complex native filters), they release internal structures and invalidate pointers.\n* **Exploitation:** By forcing `decodeData()` to execute on these now-freed objects, an attacker triggers undefined behavior. In a heap-groomed environment, an attacker could potentially replace the freed filter object with a malicious payload before the \"Zombie\" `decodeData` call occurs. This would allow for vtable hijacking or arbitrary write-what-where primitives, leading to **Remote Code Execution (RCE)**.\n* **Risk Amplification:** This is particularly dangerous for Envoy deployments using memory-unsafe extensions or third-party filters (C++ extensions), where `onDestroy` logic is relied upon for safety.\n\n**2. Security Control Bypass:**\nThe vulnerability defeats Envoy's \"Fail-Closed\" security architecture.\n* **Scenario:** If a stream is reset due to a security violation (e.g., `StreamIdleTimeout`, `OverloadManager` rejection, or WAF triggering), this vulnerability allows the attacker to **bypass the termination**.\n* **Result:** The attacker can force the processing of \"Data\" frames on a connection that the security policy explicitly attempted to close, allowing malicious payloads to reach deeper into the filter chain or backend services despite the rejection.\n\n---\n\n## Proof of Concept (Unit Test)\n\n**Description:**\nThe attached C++ unit test (`zombie_stream_poc_test.cc`) deterministically reproduces the vulnerability. It creates a stream, manually triggers a reset (simulating an Overload), and then immediately injects a DATA frame. The test asserts that the filter's `decodeData` callback is invoked on the reset stream.\n\n```cpp\n#include \"test/common/http/conn_manager_impl_test_base.h\"\n#include \"gmock/gmock.h\"\n#include \"gtest/gtest.h\"\n\nusing testing::_;\nusing testing::Invoke;\nusing testing::NiceMock;\nusing testing::Return;\n\nnamespace Envoy {\nnamespace Http {\n\n/**\n * Proof of Concept for \"Zombie Stream Filter Execution\" (HTTP/2 Reset Re-entrancy)\n * * Logic flow:\n * 1. Open a stream with HEADERS.\n * 2. Force a stream reset (simulating an Overload or Timeout).\n * 3. Immediately inject DATA into the stream.\n * 4. ASSERT that the filter's decodeData is called despite the stream being reset.\n */\nclass ZombieStreamPocTest : public HttpConnectionManagerImplTest {\n};\n\nTEST_F(ZombieStreamPocTest, ReproducedZombieFilterExecution) {\n  setup(SetupOpts().setTracing(false));\n\n  // 1. Setup a mock filter\n  std::shared_ptr\u003cMockStreamDecoderFilter\u003e filter(new NiceMock\u003cMockStreamDecoderFilter\u003e());\n   \n  // Vuln confirmation:\n  // We expect decodeData to be called on this filter even though the stream is reset.\n  // In a secure/patched implementation, this EXPECT_CALL should fail (Times(0)).\n  EXPECT_CALL(*filter, decodeData(_, _))\n      .Times(1)\n      .WillOnce(Invoke([\u0026](Buffer::Instance\u0026, bool) -\u003e FilterDataStatus {\n          ENVOY_LOG_MISC(error, \"!!! VULNERABILITY REPRODUCED: decodeData called on a reset stream !!!\");\n          return FilterDataStatus::Continue;\n      }));\n\n  EXPECT_CALL(*filter, decodeHeaders(_, false))\n      .WillOnce(Return(FilterHeadersStatus::StopIteration));\n\n  // Register the filter\n  EXPECT_CALL(filter_factory_, createFilterChain(_))\n      .WillOnce(Invoke([\u0026](FilterChainFactoryCallbacks\u0026 callbacks) -\u003e bool {\n        auto factory = createDecoderFilterFactoryCb(filter);\n        callbacks.setFilterConfigName(\"vulnerable_filter\");\n        factory(callbacks);\n        return true;\n      }));\n\n  // 2. Start the stream\n  EXPECT_CALL(*codec_, dispatch(_))\n      .WillOnce(Invoke([\u0026](Buffer::Instance\u0026) -\u003e Http::Status {\n        decoder_ = \u0026conn_manager_-\u003enewStream(response_encoder_);\n        RequestHeaderMapPtr headers{new TestRequestHeaderMapImpl{\n            {\":authority\", \"host\"}, {\":path\", \"/\"}, {\":method\", \"POST\"}}};\n        decoder_-\u003edecodeHeaders(std::move(headers), false);\n        return Http::okStatus();\n      }));\n\n  // Dispatch headers\n  Buffer::OwnedImpl header_buffer(\"headers\");\n  conn_manager_-\u003eonData(header_buffer, false);\n\n  // 3. Trigger a Reset on the ActiveStream\n  // This simulates Envoy terminating the stream due to an external event (Overload, Timeout).\n  auto* active_stream = dynamic_cast\u003cConnectionManagerImpl::ActiveStream*\u003e(decoder_);\n  \n  // This sets state_.saw_downstream_reset_ = true and triggers filter-\u003eonDestroy()\n  active_stream-\u003eonResetStream(StreamResetReason::LocalReset, \"simulated_overload\");\n\n  // 4. Attack: Send DATA to the \"Zombie\" stream\n  // The ActiveStream object is still alive in the deferred delete list.\n  Buffer::OwnedImpl malicious_payload(\"attacker_data\");\n   \n  // This call reaches the filter because FilterManager::decodeData misses the check!\n  active_stream-\u003edecodeData(malicious_payload, false);\n}\n\n} // namespace Http\n} // namespace Envoy\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-10T18:31:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-84xm-r438-86px","https://nvd.nist.gov/vuln/detail/CVE-2026-26311","https://github.com/advisories/GHSA-84xm-r438-86px"],"source_kind":"github","identifiers":["GHSA-84xm-r438-86px","CVE-2026-26311"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-10T19:00:07.665Z","updated_at":"2026-10-16T06:05:04.503Z","epss_percentage":0.00494,"epss_percentile":0.40535,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NHhtLXI0MzgtODZweM4ABTYC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04NHhtLXI0MzgtODZweM4ABTYC","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.34.12"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.35.0, \u003c= 1.35.8"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.4"},{"first_patched_version":null,"vulnerable_version_range":"= 1.37.0"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NHhtLXI0MzgtODZweM4ABTYC/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01NmNqLXdnZzMteDk0M84ABTX2","url":"https://github.com/advisories/GHSA-56cj-wgg3-x943","title":"Envoy affected by off-by-one write in JsonEscaper::escapeString()","description":"### Summary\n\n  An off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt\n  std::string null-termination, causing undefined behavior and potentially\n  leading to crashes or out-of-bounds reads when the resulting string is later\n  treated as a C-string.\n\n  ### Details\n\n  The bug is in the control-character escaping path in source/common/common/\n  json_escape_string.h:67.\n\n  - The function pre-sizes result to the final length: std::string\n    result(input.size() + required_size, '\\\\');\n  - For control characters (0x00..0x1f), it emits a JSON escape sequence of\n    length 6: \\u00XX.\n  - It uses sprintf(\u0026result[position + 1], \"u%04x\", ...), which writes 5 chars +\n    a trailing NUL (\\0) starting at result[position + 1].\n  - Then it does position += 6; and writes result[position] = '\\\\'; to overwrite\n    the NUL.\n  - If the control character occurs at the end of the output (e.g., the input\n    ends with \\x01), then after position += 6, position == result.size(), so\n    result[position] is one past the end (off-by-one), violating std::string\n    bounds/contract.\n\n  Concretely, the problematic lines are:\n\n  - source/common/common/json_escape_string.h:69 (sprintf(...))\n  - source/common/common/json_escape_string.h:72 (result[position] = '\\\\';)\n\n  Potentially reachable from request-driven paths that escape untrusted data,\n  e.g. invalid header reporting:\n\n  - source/common/http/header_utility.cc:538 ~ source/common/http/\n    header_utility.cc:546 (escapes invalid header key for error text)\n\n  Even when this doesn’t immediately crash, it can break the std::string\n  requirement that c_str()[size()] == '\\0', which can later trigger UB (e.g., if\n  passed to strlen, printf(\"%s\"), or any C API that expects NUL termination).\n  \n  \n  ```cpp\n//clang++ -std=c++20 -O0 -g -fsanitize=address -fno-omit-frame-pointer\n  repro_json_escape_asan.cc -o repro_json_escape_asan\n  ASAN_OPTIONS=abort_on_error=1 ./repro_json_escape_asan\n#include \u003ccstdint\u003e\n  #include \u003ccstdio\u003e\n  #include \u003ccstring\u003e\n  #include \u003cstring\u003e\n  #include \u003cstring_view\u003e\n\n  static uint64_t extraSpace(std::string_view input) {\n    uint64_t result = 0;\n    for (unsigned char c : input) {\n      switch (c) {\n      case '\\\"':\n      case '\\\\':\n      case '\\b':\n      case '\\f':\n      case '\\n':\n      case '\\r':\n      case '\\t':\n        result += 1;\n        break;\n      default:\n        if (c == 0x00 || (c \u003e 0x00 \u0026\u0026 c \u003c= 0x1f)) {\n          result += 5;\n        }\n        break;\n      }\n    }\n    return result;\n  }\n\n  static std::string escapeString(std::string_view input, uint64_t\n  required_size) {\n    std::string result(input.size() + required_size, '\\\\');\n    uint64_t position = 0;\n\n    for (unsigned char character : input) {\n      switch (character) {\n      case '\\\"':\n        result[position + 1] = '\\\"';\n        position += 2;\n        break;\n      case '\\\\':\n        position += 2;\n        break;\n      case '\\b':\n        result[position + 1] = 'b';\n        position += 2;\n        break;\n      case '\\f':\n        result[position + 1] = 'f';\n        position += 2;\n        break;\n      case '\\n':\n        result[position + 1] = 'n';\n        position += 2;\n        break;\n      case '\\r':\n        result[position + 1] = 'r';\n        position += 2;\n        break;\n      case '\\t':\n        result[position + 1] = 't';\n        position += 2;\n        break;\n      default:\n        if (character == 0x00 || (character \u003e 0x00 \u0026\u0026 character \u003c= 0x1f)) {\n          std::sprintf(\u0026result[position + 1], \"u%04x\",\n  static_cast\u003cint\u003e(character));\n          position += 6;\n          // Off-by-one when this escape is the last output chunk:\n          // position can become result.size(), so result[position] is out of\n  bounds.\n          result[position] = '\\\\';\n        } else {\n          result[position++] = static_cast\u003cchar\u003e(character);\n        }\n        break;\n      }\n    }\n\n    return result;\n  }\n\n  int main() {\n    std::string input(4096, 'A');\n    input.push_back('\\x01'); // ends with a control char -\u003e triggers the buggy\n  path at the end\n\n    const uint64_t required = extraSpace(input);\n    std::string escaped = escapeString(input, required);\n\n    std::printf(\"escaped.size=%zu\\n\", escaped.size());\n    unsigned char terminator = static_cast\u003cunsigned char\u003e(escaped.c_str()\n  [escaped.size()]);\n    std::printf(\"escaped.c_str()[escaped.size()] = 0x%02x\\n\", terminator);\n\n    // If NUL termination is corrupted, this can read past the logical end.\n    std::printf(\"strlen(escaped.c_str()) = %zu\\n\",\n  std::strlen(escaped.c_str()));\n    return 0;\n  }```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-10T18:30:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-56cj-wgg3-x943","https://nvd.nist.gov/vuln/detail/CVE-2026-26309","https://github.com/advisories/GHSA-56cj-wgg3-x943"],"source_kind":"github","identifiers":["GHSA-56cj-wgg3-x943","CVE-2026-26309"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-10T19:00:07.665Z","updated_at":"2026-10-16T06:05:04.504Z","epss_percentage":0.00432,"epss_percentile":0.35517,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01NmNqLXdnZzMteDk0M84ABTX2","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01NmNqLXdnZzMteDk0M84ABTX2","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.34.12"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.35.0, \u003c= 1.35.8"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.4"},{"first_patched_version":null,"vulnerable_version_range":"= 1.37.0"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01NmNqLXdnZzMteDk0M84ABTX2/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1naGM0LTM1eDYtY3J3Nc4ABTX1","url":"https://github.com/advisories/GHSA-ghc4-35x6-crw5","title":"Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation","description":"## 1. Summary\nThe Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically \"Deny\" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms.\n\n## 2. Attack Scenario\nConsider an environment where an administrator wants to block external access to internal resources using a specific header flag.\n\n### Configuration\nThe Envoy proxy is configured with a **Deny** rule to reject requests containing the header `internal: true`.\n* **Rule Type:** Exact Match\n* **Target:** `internal` header must not equal `true`.\n\n### The Bypass Logic\n1.  **Standard Request (Blocked):**\n    * **Input:** `internal: true`\n    * **Envoy Processing:** Sees string `\"true\"`.\n    * **Result:** Match found. **Request Denied.**\n\n2.  **Exploit Request (Bypassed):**\n    * **Input:**\n        ```http\n        internal: true\n        internal: true\n        ```\n    * **Envoy Processing:** Concatenates values into `\"true,true\"`.\n    * **Matcher Evaluation:** Does `\"true,true\"` equal `\"true\"`? **No.**\n    * **Result:** The Deny rule fails to trigger. **Request Allowed.**\n\n## 3. Implications\n* **RBAC Bypass:** Remote attackers can bypass configured access controls.\n* **Unauthorized Access:** Sensitive internal resources or administrative endpoints protected by header-based Deny rules become accessible.\n* **Risk:** High, particularly for deployments relying on \"Exact Match\" strategies for security blocking.\n\n## 4. Reproduction Steps\nTo verify this vulnerability:\n\n1.  **Deploy Envoy:** Configure an instance with an RBAC **Deny** rule that performs an **exact match** on a specific header (e.g., `internal: true`).\n2.  **Baseline Test:** Send a request containing the header `internal: true`.\n    * *Observation:* Envoy blocks this request (HTTP 403).\n3.  **Exploit Test:** Send a second request containing the same header twice:\n    ```http\n    GET /restricted-resource HTTP/1.1\n    Host: example.com\n    internal: true\n    internal: true\n    ```\n    * *Observation:* Envoy allows the request, granting access to the resource.\n\n## 6. Recommendations\n**Fix Header Validation Logic:**\nModify the RBAC filter to validate each header value instance individually. Avoid relying on the concatenated string output of `getAllOfHeaderAsString()` for security-critical matching unless the matcher is explicitly designed to parse comma-separated lists.\n\n** Examine the DENY role to use a Regex style fix.\n\n**Credit:** Dor Konis","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-10T18:30:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-ghc4-35x6-crw5","https://nvd.nist.gov/vuln/detail/CVE-2026-26308","https://github.com/envoyproxy/envoy/commit/b6ba0b2294b98484fb0ed8556897d1073cc27867","https://github.com/advisories/GHSA-ghc4-35x6-crw5"],"source_kind":"github","identifiers":["GHSA-ghc4-35x6-crw5","CVE-2026-26308"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-10T19:00:07.665Z","updated_at":"2026-10-16T06:04:14.705Z","epss_percentage":0.00358,"epss_percentile":0.2753,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naGM0LTM1eDYtY3J3Nc4ABTX1","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1naGM0LTM1eDYtY3J3Nc4ABTX1","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":"1.34.13","vulnerable_version_range":"\u003c= 1.34.12"},{"first_patched_version":"1.35.9","vulnerable_version_range":"\u003e= 1.35.0, \u003c= 1.35.8"},{"first_patched_version":"1.36.5","vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.4"},{"first_patched_version":"1.37.1","vulnerable_version_range":"= 1.37.0"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naGM0LTM1eDYtY3J3Nc4ABTX1/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zY3c2LTJqNjgtODY4cM4ABTXq","url":"https://github.com/advisories/GHSA-3cw6-2j68-868p","title":"Envoy vulnerable to crash for scoped ip address during DNS","description":"### Summary\n\nCalling `Utility::getAddressWithPort` with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter.\n\n### Details\n\nThe crashing function is `Utility::getAddressWithPort`. The crash occurs if a string containing a scoped IPv6 address is passed to this function.\n\nThis vulnerability affects:\n\n1. The **original src filter**: If the filter is configured and the original source is a scoped IPv6 address, it will cause a crash.\n2. **DNS response address resolution**: If a DNS response contains a scoped IPv6 address, this will also trigger the crash.\n\n### PoC\n\nTo reproduce the vulnerability:\n\n1. **Method A (Original Src Filter):** Configure the `original src` filter in Envoy and provide a scoped IPv6 address as the original source.\n2. **Method B (DNS Resolution):** Trigger a DNS resolution process within Envoy where the DNS response contains a scoped IPv6 address.\n\n### Impact\n\nThis is a Denial of Service (DoS) vulnerability. It impacts users who have the `original src` filter configured or whose Envoy instances resolve addresses from DNS responses that may contain scoped IPv6 addresses.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-10T18:16:26.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cw6-2j68-868p","https://nvd.nist.gov/vuln/detail/CVE-2026-26310","https://github.com/advisories/GHSA-3cw6-2j68-868p"],"source_kind":"github","identifiers":["GHSA-3cw6-2j68-868p","CVE-2026-26310"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-10T19:00:07.665Z","updated_at":"2026-10-16T06:05:04.509Z","epss_percentage":0.00475,"epss_percentile":0.39546,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zY3c2LTJqNjgtODY4cM4ABTXq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zY3c2LTJqNjgtODY4cM4ABTXq","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 1.34.12"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.35.0, \u003c= 1.35.8"},{"first_patched_version":null,"vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.4"},{"first_patched_version":null,"vulnerable_version_range":"= 1.37.0"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zY3c2LTJqNjgtODY4cM4ABTXq/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yd2pnLWMzaDItZjU3cM4ABPOO","url":"https://github.com/advisories/GHSA-rwjg-c3h2-f57p","title":"Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte","description":"### Summary\nEnvoy’s mTLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte (\\0) inside an `OTHERNAME` SAN value as valid matches.\n\n### Details\nThis occurs when the SAN is encoded as a `BMPSTRING` or `UNIVERSALSTRING`, and its UTF-8 conversion result is truncated at the first null byte during string assignment. As a result, `\"victim\\0evil\"` may match an exact: `\"victim\"` rule and be accepted by Envoy.\n\n### PoC\n\nCreate a CA and a server certificate signed by that CA.\nCreate two client certificates signed by the same CA:\nclient_evil with OTHERNAME BMPSTRING = \"evil\"\nclient_null with OTHERNAME BMPSTRING = \"victim\\0evil\"\nConfigure Envoy with require_client_certificate: true and a match_typed_subject_alt_names entry for the OTHERNAME OID with matcher.exact: \"victim\".\nConnect without a client cert → connection rejected.\nConnect with client_evil → connection rejected.\nConnect with client_null → connection accepted (but shouldn't!).\n\n### Impact\nAn attacker who can obtain a trusted client certificate with a null byte embedded in an OTHERNAME SAN can exploit this vulnerability. The practical impact is unauthorized impersonation of the matched identity, enabling access to services or APIs protected by that exact OTHERNAME check.\n\n### Credit\n[markevich.nikita1@gmail.com](mailto:markevich.nikita1@gmail.com)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-12-05T18:14:02.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p","https://nvd.nist.gov/vuln/detail/CVE-2025-66220","https://github.com/advisories/GHSA-rwjg-c3h2-f57p"],"source_kind":"github","identifiers":["GHSA-rwjg-c3h2-f57p","CVE-2025-66220"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-05T19:00:08.648Z","updated_at":"2026-10-16T06:06:08.063Z","epss_percentage":0.00168,"epss_percentile":0.05512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yd2pnLWMzaDItZjU3cM4ABPOO","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yd2pnLWMzaDItZjU3cM4ABPOO","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":"1.33.13","vulnerable_version_range":"\u003c= 1.33.12"},{"first_patched_version":"1.34.11","vulnerable_version_range":"\u003e= 1.34.0, \u003c= 1.34.10"},{"first_patched_version":"1.35.7","vulnerable_version_range":"\u003e= 1.35.0, \u003c= 1.35.6"},{"first_patched_version":"1.36.3","vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.2"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yd2pnLWMzaDItZjU3cM4ABPOO/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yajM1LTRtOTQtNzdqaM4ABPON","url":"https://github.com/advisories/GHSA-rj35-4m94-77jh","title":"Envoy forwards early CONNECT data in TCP proxy mode","description":"## Summary\n\nForwarding of early CONNECT data in TCP proxy mode.\n\n## Details\n\nPer [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies)  switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.\n\nThe RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. \n\n## Impact\n\nDe-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.\n\n## Attack vector(s)\nSending data for a CONNECT request before receiving 2xx response.\n\n## Patches\nUsers should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13\n\n## Credits\n\n[chasingimpact](https://github.com/chasingimpact) (Patrick)","origin":"UNSPECIFIED","severity":"LOW","published_at":"2025-12-05T18:12:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":3.7,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh","https://nvd.nist.gov/vuln/detail/CVE-2025-64763","https://github.com/advisories/GHSA-rj35-4m94-77jh"],"source_kind":"github","identifiers":["GHSA-rj35-4m94-77jh","CVE-2025-64763"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-05T19:00:08.648Z","updated_at":"2026-10-16T06:06:08.064Z","epss_percentage":0.00301,"epss_percentile":0.20505,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yajM1LTRtOTQtNzdqaM4ABPON","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yajM1LTRtOTQtNzdqaM4ABPON","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":"1.33.13","vulnerable_version_range":"\u003c= 1.33.12"},{"first_patched_version":"1.34.11","vulnerable_version_range":"\u003e= 1.34.0, \u003c= 1.34.10"},{"first_patched_version":"1.35.7","vulnerable_version_range":"\u003e= 1.35.0, \u003c= 1.35.6"},{"first_patched_version":"1.36.3","vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.2"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yajM1LTRtOTQtNzdqaM4ABPON/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tcDg1LTdtcnEtcjg2Ns4ABPOM","url":"https://github.com/advisories/GHSA-mp85-7mrq-r866","title":"Envoy crashes when JWT authentication is configured with the remote JWKS fetching","description":"### Summary\nEnvoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.\n\n### Details\nThis is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object.\n\nThe original callback's reset() then clears the second fetch's state (`receiver_ and request_`) which causes a crash when the async HTTP response arrives.\n\n### PoC\n* `allow_missing_or_failed` or `allow_missing` is enabled\n* The client send 2 Authorization headers\n* the remote JWKS fetching failed\n* There will be crash\n\n### Impact\nDoS and Crash\n\n### Mitigation\n* Disable the `allow_missing_or_failed` or `allow_missing`","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-12-05T18:12:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866","https://nvd.nist.gov/vuln/detail/CVE-2025-64527","https://github.com/advisories/GHSA-mp85-7mrq-r866"],"source_kind":"github","identifiers":["GHSA-mp85-7mrq-r866","CVE-2025-64527"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-05T19:00:08.648Z","updated_at":"2026-10-16T06:06:08.065Z","epss_percentage":0.0053,"epss_percentile":0.4354,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcDg1LTdtcnEtcjg2Ns4ABPOM","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tcDg1LTdtcnEtcjg2Ns4ABPOM","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":"1.33.13","vulnerable_version_range":"\u003c= 1.33.12"},{"first_patched_version":"1.34.11","vulnerable_version_range":"\u003e= 1.34.0, \u003c= 1.34.10"},{"first_patched_version":"1.35.7","vulnerable_version_range":"\u003e= 1.35.0, \u003c= 1.35.6"},{"first_patched_version":"1.36.3","vulnerable_version_range":"\u003e= 1.36.0, \u003c= 1.36.2"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcDg1LTdtcnEtcjg2Ns4ABPOM/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nOXZ3LTZwdngtN2dtd84ABMIM","url":"https://github.com/advisories/GHSA-g9vw-6pvx-7gmw","title":"Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults","description":"### Summary\n\nA use-after-free (UAF) vulnerability in Envoy's DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.\n\n### Details\n\nThe vulnerability exists in Envoy's Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:\n\n1. Dynamic Forwarding Filter is enabled.\n2. `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled.\n3. The Host header is modified between the Dynamic Forwarding Filter and Router filters.\n\n### Impact\n\nDenial of service due to abnormal process termination.\n\n### Attack vector(s)\nRequest to Envoy configured as indicated above.\n\n### Patches\nUsers should upgrade to v1.35.1 or v1.34.5. \n\n### Workaround\nSet the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag to `false`.\n\n### Detection\nAbnormal process termination with the `Envoy::Event::DispatcherImpl::runPostCallbacks()` frame in the call stack.\n\n### Credits\nRohit Agrawal ([agrawroh](https://github.com/agrawroh)) ([rohit.agrawal@databricks.com](mailto:rohit.agrawal@databricks.com))","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-09-15T16:46:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw","https://nvd.nist.gov/vuln/detail/CVE-2025-54588","https://github.com/envoyproxy/envoy/releases/tag/v1.34.5","https://github.com/envoyproxy/envoy/releases/tag/v1.35.1","https://github.com/advisories/GHSA-g9vw-6pvx-7gmw"],"source_kind":"github","identifiers":["GHSA-g9vw-6pvx-7gmw","CVE-2025-54588"],"repository_url":"https://github.com/envoyproxy/envoy","blast_radius":0.0,"created_at":"2025-09-15T17:09:30.860Z","updated_at":"2026-10-16T06:06:41.260Z","epss_percentage":0.00475,"epss_percentile":0.39517,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nOXZ3LTZwdngtN2dtd84ABMIM","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nOXZ3LTZwdngtN2dtd84ABMIM","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":"1.34.5","vulnerable_version_range":"\u003e= 1.34.0, \u003c 1.34.5"},{"first_patched_version":"1.35.1","vulnerable_version_range":"= 1.35.0"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nOXZ3LTZwdngtN2dtd84ABMIM/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jZjNxLWdxZzctM2ZtOc4ABFxI","url":"https://github.com/advisories/GHSA-cf3q-gqg7-3fm9","title":"Envoy crashes when HTTP ext_proc processes local replies","description":"### Summary\nEnvoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.\n\n### PoC\nIf both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash.\n\n### Mitigation\n1. Disable websocket traffic\n2. Change the websocket response from backend to always return `101 Switch protocol` based on RFC.\n3. Apply the patch and the ext_proc filter will not send the local reply that is generated by Envoy to the ext_proc server for processing.\n4. Apply the patch that the router will cancel the upstream requests when sending a local reply.\n\n### Impact\nDenial of service\n\n### Reporter\nVasilios Syrakis\nFernando Cainelli","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-03-21T15:23:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9","https://nvd.nist.gov/vuln/detail/CVE-2025-30157","https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c","https://github.com/advisories/GHSA-cf3q-gqg7-3fm9"],"source_kind":"github","identifiers":["GHSA-cf3q-gqg7-3fm9","CVE-2025-30157"],"repository_url":"https://github.com/envoyproxy/envoy","blast_radius":0.0,"created_at":"2025-03-21T16:08:26.101Z","updated_at":"2026-10-16T06:07:39.156Z","epss_percentage":0.00436,"epss_percentile":0.36295,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jZjNxLWdxZzctM2ZtOc4ABFxI","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jZjNxLWdxZzctM2ZtOc4ABFxI","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":"1.33.1","vulnerable_version_range":"\u003e= 1.33.0, \u003c 1.33.1"},{"first_patched_version":"1.32.4","vulnerable_version_range":"\u003e= 1.32.0, \u003c 1.32.4"},{"first_patched_version":"1.31.6","vulnerable_version_range":"\u003e= 1.31.0, \u003c 1.31.6"},{"first_patched_version":"1.30.10","vulnerable_version_range":"\u003c 1.30.10"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jZjNxLWdxZzctM2ZtOc4ABFxI/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yd21mLXA3ZjgtdzQyaM4AAgj4","url":"https://github.com/advisories/GHSA-2wmf-p7f8-w42h","title":"EnvoyProxy Envoy Missing HTTP URL path normalization","description":"Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-05-24T16:44:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":10.0,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w","https://nvd.nist.gov/vuln/detail/CVE-2019-9901","https://github.com/envoyproxy/envoy/issues/6435","https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM","https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history","https://github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md","https://github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8","https://github.com/advisories/GHSA-2wmf-p7f8-w42h"],"source_kind":"github","identifiers":["GHSA-2wmf-p7f8-w42h","CVE-2019-9901"],"repository_url":"https://github.com/envoyproxy/envoy","blast_radius":0.0,"created_at":"2023-07-14T21:03:51.075Z","updated_at":"2026-10-16T06:13:24.275Z","epss_percentage":0.04951,"epss_percentile":0.91776,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yd21mLXA3ZjgtdzQyaM4AAgj4","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yd21mLXA3ZjgtdzQyaM4AAgj4","packages":[{"ecosystem":"go","package_name":"github.com/envoyproxy/envoy","versions":[{"first_patched_version":"1.9.1","vulnerable_version_range":"\u003c= 1.9.0"}],"purl":"pkg:go/github.com%2Fenvoyproxy%2Fenvoy"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yd21mLXA3ZjgtdzQyaM4AAgj4/related_packages","related_advisories":[]}]