Debian/octavia: unknown
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes c
Action: Upgrade octavia to 18.0.0-4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 18.0.0-4 | - |
Fixed versions
| 18.0.0-4 |
Sources
- osv: DEBIAN-CVE-2026-94571#Debian:14/octavia
- https://security-tracker.debian.org/tracker/CVE-2026-94571
published · modified · JSON