Envoy

Check if affected (2)

• ▸▾securityGHSA-8vc2-jrm4-835w in the oauth2 filter

  Applies to CONNECT requests without a :path header.

  The oauth2 filter now rejects requests without a :path header with 400. This fixes GHSA-8vc2-jrm4-835w.

  GHSA-8vc2-jrm4-835w

• ▸▾securityGHSA-47vj-9r25-wv5j in the api_key_auth filter

  Applies if hide_credentials is enabled with a query key source.

  The api_key_auth filter crash is fixed for requests without a :path header that are authenticated through another key source when hide_credentials is enabled with a query key source. This addresses GHSA-47vj-9r25-wv5j.

  GHSA-47vj-9r25-wv5j