Affected by GO-2025-3418
and 9 other vulnerabilities
GO-2025-3418: Envoy Admin Interface Exposed through prometheus metrics endpoint in github.com/envoyproxy/gateway
GO-2025-3504: Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway
GO-2026-4312: Envoy Extension Policy lua scripts injection causes arbitrary command execution in github.com/envoyproxy/gateway
GO-2026-6003: Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway
GO-2026-6005: Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock in github.com/envoyproxy/gateway
GO-2026-6006: Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway
GO-2026-6007: Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway
GO-2026-6008: Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header in github.com/envoyproxy/gateway
GO-2026-6009: Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway
GO-2026-6011: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway
package
Version:
v1.2.5
Opens a new window with list of versions in this module.
Published: Jan 14, 2025
License: Apache-2.0
Opens a new window with license information.
Imports: 10
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
¶
ValidateEnvoyGateway validates the provided EnvoyGateway.
ValidateEnvoyProxy validates the provided EnvoyProxy.
ValidateJWTProvider validates the provided JWT authentication configuration.
ValidateSecurityPolicy validates the provided SecurityPolicy.
Source Files
¶
Click to show internal directories.
Click to hide internal directories.
