Envoy

Check if affected (2)

• ▸▾securityGHSA-8vc2-jrm4-835w in the oauth2 filter

  Applies if you use the oauth2 extension.

  GHSA-8vc2-jrm4-835w fixes a crash in the oauth2 filter for requests without a :path header, including CONNECT requests. The filter now rejects these requests with HTTP 400.

  GHSA-8vc2-jrm4-835w

• ▸▾securityGHSA-47vj-9r25-wv5j in the api_key_auth filter

  Applies if you use the api_key_auth extension, configure hide_credentials, and configure query.

  GHSA-47vj-9r25-wv5j fixes a crash in the api_key_auth filter when hide_credentials is enabled with a query key source and a request without a :path header is authenticated through another key source.

  GHSA-47vj-9r25-wv5j