Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

linkerd/linkerd2

              main @ eadc1ac
            

127

Fixes

CVEs

HIGH

Peak severity

52.0%

Coverage

Highlights

Denial of Service: 62 prior fixes. Scrutinize any change in this area.

proxy: most-fixed (24 issues). Treat as high-risk during review.

44 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Incomplete status checks or improper caching on inbound and outbound routing resources could lead to traffic authorization bypasses. Ensuring correct parent service type checks, validation status filters, and proper route map deletion are essential steps to keep policies consistent.

Denial of Service: The proxy is historically susceptible to CPU and memory exhaustion caused by infinite loops, resource leaks in connection caches, and unhandled 0-byte reads during protocol selection or stream failures.

Auth Bypass: The tap component's diagnostic capabilities were exposed to authorization bypasses via direct network connections and missing client identity checks, requiring strict subjectaccessreview constraints and TLS identity validation.