Skip to content

v0.17.20

Choose a tag to compare

View all tags
@dadrus dadrus released this 07 Aug 10:50
v0.17.20
f23786d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.17.20 (2026-08-07)

In addition to the updates and bug fixes listed below, this release addresses the following security-critical issues:

  • Path re-encoding in decision mode may bypass path guards and lead to authorization bypass (GHSA-r9fw-vxmp-hwf2). Fixed in #3421.
  • Inconsistent path captures during route lookup backtracking may lead to incorrect rule selection and authorization bypass (#3412). Fixed in #3419.
  • Default JWT and OAuth2 token extraction may buffer unbounded request bodies, allowing unauthenticated clients to cause excessive memory consumption and potentially exhaust process memory (#3424). Fixed in #3425.

Please check whether you are affected and update immediately!

Bug Fixes

  • Canonicalized request header names in Envoy gRPC ext_authz (#3423) (a6eb158)
  • HTTP cache updated to honor Vary response headers (#3418) (17021db)
  • Percent-encoded path components preserved during request normalization (#3421) (f8243a1)
  • Preserve path captures during route lookup backtracking (#3419) (a9b6ea0)
  • Prevented potential crashes under concurrent access during OAuth2 metadata endpoint initialization (#3416) (2101c2f)
  • Removed implicit request body token extraction from JWT and OAuth2 authenticators (#3425) (2597a0e)

Dependencies

  • update google.golang.org/protobuf digest to 644d026 (#3413) (0a54851)
  • update module github.com/knadh/koanf/parsers/yaml to v1.1.1 (#3398) (9c34664)
  • update module github.com/knadh/koanf/providers/confmap to v1.0.1 (#3399) (8c40185)
  • update module github.com/knadh/koanf/providers/env/v2 to v2.0.1 (#3400) (bb7d902)
  • update module github.com/knadh/koanf/providers/rawbytes to v1.0.1 (#3401) (5e61595)
  • update module github.com/knadh/koanf/providers/structs to v1.0.1 (#3402) (7f0caf3)
  • update module github.com/knadh/koanf/v2 to v2.3.6 (#3403) (1745ac3)
  • update module github.com/santhosh-tekuri/jsonschema/v6 to v6.0.3 (#3414) (601d89c)
  • update opentelemetry-go monorepo to v1.45.0 (#3395) (1b5d96b)
  • update opentelemetry-go-contrib monorepo to v0.70.0 (#3404) (68024ae)
Assets 27
Loading