Remediating CVEs Across the Stack: Who’s Handling Your Response?

Back-to-back CVE announcements bring a stack of work: identify affected components, test the fixes, track upstream releases, and get patches into production. When the vulnerabilities affect different layers of your Kubernetes environments, each update comes with its own dependencies and rollout decisions.

In late October, Fairwinds handled that work for our Managed Kubernetes-as-a-Service clients, coordinating responses to http2shell and the eMudhra certificate authority vulnerability. The response spanned kgateway, cert-manager, metrics-server, and cluster node operating systems.

Those two were part of broader remediation efforts. Fairwinds recently completed 21 CVE fixes across the managed fleet, and 17 of those fixes reached more than 80% of our clusters. The largest single event was one Envoy security release containing 13 CVEs, which we patched across all affected clusters.

CVEs Covered by the Response

One Envoy Release, 13 CVEs

The release addressed vulnerabilities in HTTP handling, authorization, and URL normalization, among other areas, detailed in Envoy’s security advisories. The bugs included an HTTP/3 use-after-free issue, request smuggling through a shared upstream connection, and an RBAC authorization bypass involving appended path parameters.

Other fixes addressed process termination in HTTP/2 and HTTP/3, crashes involving scoped IPv6 addresses, and how dropped Host headers counted toward request-header limits. The release also corrected character-set handling in regular expressions used for HTTP headers.

Fairwinds deployed the release across our clients' clusters, covering 92% of the managed fleet. Those 13 CVEs accounted for more than half of the 21 completed fixes in the broader response.

That work was followed by a separate Envoy-related response when the Brotli decompressor vulnerability required updates to kgateway.

Patching kgateway for http2shell

http2shell, CVE-2026-111497, involves an out-of-bounds write in the Brotli decompressor and affects Envoy and other HTTP-handling packages.

For Fairwinds’ clients, that response included deploying patched versions of kgateway. The team began rolling out updates to non-production environments on the morning of October 26 and completed the rollout that afternoon.

Production updates followed. By the evening of October 27, all production kgateway installations had been patched. Additional checks and remediation followed that rollout.

Updating Certificate Trust After the eMudhra Vulnerability

At the same time, the team was coordinating certificate trust updates for the eMudhra intermediate CA key issue. The response covered software components and node operating systems, each with its own update requirements.

Fairwinds’ work included:

• GKE nodes: Deploying updated Container-Optimized OS images.
• cert-manager: Rolling out patched versions across non-production and production environments.
• metrics-server: Updating its image to remove eMudhra roots from its CA bundle.
• Bottlerocket nodes: Tracking release availability and testing updates for Karpenter nodes and EKS managed node groups.
• Ubuntu nodes: Testing an updated OS trust store internally and including the update where applicable.

The team began deploying cert-manager patches and updated GKE node images to non-production environments on October 26. Production updates followed.

The Bottlerocket update wasn’t initially available to every node configuration. During internal testing, the updated version was available for Karpenter nodes before an EKS managed node group could successfully use it. The team tracked the release and subsequently confirmed that a managed node group could pull the official version.

Fairwinds quickly completed the eMudhra-related certificate trust updates across all managed clusters.

Different Components, Different Deployment Scopes

Deployment scope varied across the other components, too. Fairwinds completed fixes across all affected clusters for the EKS network policy agent, SSM Agent, EFS CSI Driver, and AWS Private CA Connector for Kubernetes.

Other fixes only required remediation on a few clients' clusters: an AWS SDK for Go v2 denial-of-service issue and two GitLab vulnerabilities.

Who’s Handling Your Next CVE Response?

CVE volume is growing, and a single response can involve updates across several layers of your Kubernetes environment. Managed Kubernetes gives you one team to coordinate those updates and apply patches consistently across affected clusters.

Managing security updates is part of Fairwinds’ ongoing responsibility for our clients’ Kubernetes environments. Your team doesn’t have to track each advisory, test each fix, and coordinate every rollout. Fairwinds handles that work for you.

If your team doesn’t want to have to drop everything to chase down the next critical CVE, let us handle it for you. Learn about Fairwinds Managed Kubernetes-as-a-Service.