OC
Product
Octavia
5
CVEs
0
On KEV
9.4
Max CVSS
0
New 30D
Severity mix
Critical 2High 2Medium 1Low 0
Watch
Add Octavia to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-94572 | 9.4 | Sep 21 | In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters Affected: 6.0.0 before 16.1.0; 17.0.0 before 17.0.1; 18.0.0 before 18.0.1 |
| CVE-2026-94571 | 9.4 | Sep 21 | In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields Affected: 0.8.0 before 16.1.0; 17.0.0 before 17.0.1; 18.0.0 before 18.0.1 |
| CVE-2019-3895 | 8.0 | Jun 3 | An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director Affected: before 0.9.0 |
| CVE-2018-16856 | 7.5 | Mar 26 | In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log… Affected: 2.0.0 before 2.0.2-5; 3.0.0 before 3.0.1-0.20181009115732 |
| CVE-2026-74248 | 4.3 | Aug 14 | OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization Affected: before 16.0.2; 17.0.0; 18.0.0 |
Showing 5