Octavia vulnerabilities

2 known vulnerabilities in Octavia from OpenStack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  Octavia: Improper Control of Generation of Code

  CVE-2026-94572Sep 21, 2026OpenStack

  In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated pr

• 9.4 Critical severity

  Octavia: Improper Control of Generation of Code

  CVE-2026-94571Sep 21, 2026OpenStack

  In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passe