Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

envoyproxy/envoy

              main @ 13f8e4b
            

167

Fixes

CVEs

HIGH

Peak severity

26.3%

Coverage

Highlights

Denial of Service: 88 prior fixes. Scrutinize any change in this area.

source/extensions/filters/http/oauth2/filter.cc: most-fixed (7 issues). Treat as high-risk during review.

100 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass RBAC and other security policies configured with multi-valued or duplicate headers. Evaluating duplicate header values as a single concatenated string rather than individual elements allows bypasses of HeaderMatcher rules. This was corrected across both general and RBAC-specific matching paths to avoid split-parser confusion.

Denial of Service: Improper stream termination state tracking allows filter chain iteration to continue on reset or deleted stream contexts. In particular, failing to halt iteration immediately when a local reply is sent, or executing filter callbacks after a stream reset, leads to null pointer dereferences or use-after-free crashes.

Auth Bypass: Faulty handling of unexpected or empty gRPC status codes returned by the external authorization server causes the filter to fail open. This bypasses security controls, treating server errors or non-standard status codes as authorizations unless strict fail-closed state tracking and default 403 Forbidden falls are cleanly enforced.