Description (CNA)
Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this issue, users should upgrade to version 3.4.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Amazon / aws-load-balancer-controller | affected 0 before 3.4.2 |
CWE
CWE-653
References
- https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v3.4.2
- https://aws.amazon.com/security/security-bulletins/2026-055-aws/
ADP enrichment
No English description supplied.
No references supplied.