Contour (Projectcontour) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 172 known versions, newest CVE from 2026-08-19. Vendor: Projectcontour.

CVEs of Contour

• CVE-2026-50149 - CVSS 6.5 (medium), 2026-08-19: Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible…
• CVE-2026-41246 - CVSS 8.1 (high), 2026-04-23: Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is…
• CVE-2024-36539 - CVSS 9.8 (critical), 2024-07-24: Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
• CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
• CVE-2021-32783 - CVSS 8.5 (high), 2021-07-23: Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to…
• CVE-2020-15127 - CVSS 7.5 (high), 2020-08-05: In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress…