Affected by GO-2026-6003 and 6 other vulnerabilities

GO-2026-6003: Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway

GO-2026-6005: Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock in github.com/envoyproxy/gateway

GO-2026-6006: Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway

GO-2026-6007: Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway

GO-2026-6008: Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header in github.com/envoyproxy/gateway

GO-2026-6009: Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway

GO-2026-6011: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway

cmd

package

v1.5.9 Latest Latest Go to latest Published: Feb 11, 2026 License: Apache-2.0 Imports: 33 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/envoyproxy/gateway

Links

Open Source Insights

Documentation ¶

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func GetCertGenCommand ¶ added in v1.4.0

func GetCertGenCommand() *cobra.Command

GetCertGenCommand returns the certGen cobra command to be executed.

func GetEnvoyCommand ¶ added in v1.4.0

func GetEnvoyCommand() *cobra.Command

GetEnvoyCommand returns the envoy cobra command to be executed.

func GetServerCommand ¶ added in v1.4.0

func GetServerCommand() *cobra.Command

GetServerCommand returns the server cobra command to be executed.

func GetVersionCommand ¶ added in v1.4.0

func GetVersionCommand() *cobra.Command

GetVersionCommand returns the version cobra command to be executed.

Types ¶

type Runner ¶ added in v1.4.0

type Runner interface {
	Start(context.Context) error
	Name() string
	// Close closes the runner when the server is shutting down.
	// This called after all the subscriptions are closed at the very end of the server shutdown.
	Close() error
}

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
egctl
envoy
options
version

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL