Résumé
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
Détails de l’avis
Vulnerability report without repro case. Repro case may be added later after harness is complete.
Preconditions (4):
- Tenant has SecurityPolicy + TCPRoute RBAC (baseline)
- Tenant namespace permitted to attach TCPRoute to a Gateway listener
- spec.authorization omitted (the trigger)
- No admission webhook blocks the shape
Description:
A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.
Références
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-76905
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
- CRITICALCVE-2026-55209
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
- MEDIUMGHSA-3x6r-wxxg-53vv
rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
- HIGHCVE-2026-47427
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
- MEDIUMGHSA-jpcw-4wr7-c3vq
kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
- MEDIUMCVE-2026-59949
LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges