Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/projectcontour/contour

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 2 high, 1 medium
Registry
pkg.go.dev

Advisories 3

  • CVE-2026-50149Medium 6.5

    Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

    Affected: from 1.23.0, fixed in 1.33.5.

  • Contour: Lua code injection via Cookie Path Rewrite Policy

    Affected: from 1.19.0, fixed in 1.31.6; from 1.32.0, fixed in 1.32.5; from 1.33.0, fixed in 1.33.4; from 1.19.0, fixed in 1.31.6; from 1.32.0, fixed in 1.32.5; from 1.33.0, fixed in 1.33.4.

  • Authorization bypass in Contour

    Affected: fixed in 1.14.2; from 1.15.0, fixed in 1.15.2; from 1.16.0, fixed in 1.16.1; from 1.17.0, fixed in 1.17.1; fixed in 1.14.2; from 1.15.0, fixed in 1.15.2; from 1.16.0, fixed in 1.16.1; from 1.17.0, fixed in 1.17.1.