Routing Release
Approved changes feed: RSS · Atom
cpe:2.3:a:cloudfoundry:routing_release:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Cloudfoundry (3aa6768c-437d-5100-a420-b037598cadb4) |
|---|---|
| Product | Routing Release (70b524ce-8d23-5f50-af6f-090d684dfdbc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cloudfoundry/routing_release |
purl2cpe | 2026-06-01 10:12:05.261748 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-22726 |
vulnerable | 2026-06-03 15:15:54.029738 |
Route Services Firewall Bypass
MEDIUM (5)
Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks reachable by the Gorouter, which may not have previously had direct access from outside networks, or from the application.
Routing release: affected from v0.118.0 through v0.371.0 (inclusive); upgrade to v0.372.0 or greater. CF Deployment: affected from v0.0.2 through v54.14.0 (inclusive); upgrade to v55.0.0 or greater (includes routing_release v0.372.0).
Published: 2026-04-30T23:17:00.707Z
Updated: 2026-05-01T14:19:13.594Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22279 |
vulnerable | 2026-06-03 14:55:00.261268 |
GoRouter Denial of Service Attack
MEDIUM (5.9)
Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade
the service availability of the Cloud Foundry deployment if performed at scale.
Published: 2024-06-10T19:47:43.939Z
Updated: 2024-08-01T22:43:34.216Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-20882 |
vulnerable | 2026-06-03 14:49:05.502090 |
Details available
In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry. Under the right circumstances, when client connections are closed prematurely, gorouter marks the currently selected backend as failed and removes it from the routing pool.
Published: 2023-05-26T00:00:00.000Z
Updated: 2025-01-16T14:39:05.654Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5401 |
vulnerable | 2026-06-03 14:42:56.389119 |
Cloud Foundry GoRouter is vulnerable to cache poisoning
MEDIUM (5.3)
Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.
Published: 2020-02-27T19:30:23.717Z
Updated: 2024-09-16T17:38:11.499Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3789 |
vulnerable | 2026-06-03 14:40:27.469220 |
Gorouter allows space developer to hijack route services hosted outside the platform
HIGH (8.8)
Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.
Published: 2019-04-24T15:21:10.443Z
Updated: 2024-09-17T04:14:31.804Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.