CVE-2020-5416

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing (Gorouter) versions prior to 0.204.0

Description The issue allows an unauthenticated malicious attacker to send specially-crafted HTTP requests, potentially causing the Gorouters to be dropped from the NGINX backend pool, leading to denial-of-service attacks. This occurs when Cloud Foundry Routing (Gorouter) is used in a deployment with NGINX reverse proxies in front of the Gorouters.

Recommendations For Cloud Foundry Routing (Gorouter) versions prior to 0.204.0, update to version 0.204.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Gorouter when used with NGINX reverse proxies to minimize the risk of exploitation.