tocsin

Go/github.com/projectcontour/contour CVE-2026-41246: unknown, EPSS 0.83%

Contour has Lua code injection via Cookie Path Rewrite Policy in github.com/projectcontour/contour

Action: Upgrade github.com/projectcontour/contour to 1.31.6 or later.

go get github.com/projectcontour/contour@v1.31.6
go get github.com/projectcontour/contour@v1.32.5
go get github.com/projectcontour/contour@v1.33.4

Affected

introducedfixedlast affected
1.19.01.31.6-
1.32.01.32.5-
1.33.01.33.4-

Fixed versions

1.31.61.32.51.33.4

Sources

CVE-2026-41246 · published · modified · JSON