Fixed in this release

Bug ID · Description

556750755 · Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (>16 KB) event under load on the http-adaptor datapath.

547712217 · Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads.

519729209 · Fixed a SAML XML Signature Wrapping (XSW) vulnerability in the ValidateSAMLAssertion policy.

514384893 · Hardened the Script policy to block server-side request forgery (SSRF) to link-local addresses.

505645076 · Fixed a security issue in the OAuthV2 policy to prevent unauthorized token injection via HTTP form parameters.

505543289 · Fixed thread-safety issues in the Netty client connection pool and channel lifecycle.

503817773 · Improved security in the OAuthV2 policy implicit grant redirect_uri validation.

502268966 · Apigee hybrid now supports optional decoding of percent-encoded path separators (%2F and %5C) before flow selection via the request.path.decode.encoded.separators proxy property.

480770263 · Fixed an issue in the SpikeArrest policy to handle edge cases that previously caused NullPointerException and 500 errors.

472526232 · Improved SAML assertion validation in the ValidateSAMLAssertion policy against entity and comment injection.

470375542 · Fixed a memory leak in WSFrameDecoder that could result in a spike in 503 responses with no_healthy_upstream errors.