Logo
Retour à la veille

CVE-2026-73551

Publié : 21 septembre 2026
Modifié : 21 septembre 2026
Lien officiel NVD
Score CVSS
5.3
MEDIUM

Description détaillée

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Références et Patchs

https://github.com/envoyproxy/envoy/commit/28b6d60a6d96edeece121cac5be701eb46cc7f24https://github.com/envoyproxy/envoy/commit/d40a68b0a30a003c4e0a9fd3af637f828b52c37bhttps://github.com/envoyproxy/envoy/commit/e9d6c329f9a3ff19432bf39b60c601df7e3eda33https://github.com/envoyproxy/envoy/commit/f74d1107c4f5c9679b66f7a03a6c5b75ddde1989https://github.com/envoyproxy/envoy/releases/tag/v1.36.10https://github.com/envoyproxy/envoy/releases/tag/v1.37.6https://github.com/envoyproxy/envoy/releases/tag/v1.38.4https://github.com/envoyproxy/envoy/releases/tag/v1.39.1https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4

Dernières Vulnérabilités

CVE-2026-94627

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts, causing orphaned KV cache blocks to accumulate until process restart and eventually preventing legitimate requests from executing.

VOIR DÉTAILS

CVE-2026-94626

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.

VOIR DÉTAILS

CVE-2026-94625

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.

VOIR DÉTAILS