envoy vulnerabilities (Bitnami)
118 vulnerabilities.
-
envoyBitnami Envoy: RBAC Authorization Bypass via Path Parameters 7.5 High -
envoyBitnami Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values 7.5 High -
envoyBitnami Envoy: Path normalization does not handle dot and dotdot segments with parameters 5.3 Medium -
envoyBitnami Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy 7.5 High -
envoyBitnami Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters 5.3 Medium -
envoyBitnami Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool 7.5 High -
envoyBitnami Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check 7.5 High -
envoyBitnami Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) 7.4 High -
envoyBitnami Envoy: oghttp2 upstream trailers incorrect handling 7.5 High -
envoyBitnami Envoy: use-after-free in QUIC on internal redirects 7.5 High -
envoyBitnami Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) 5.3 Medium -
envoyBitnami Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault 5.9 Medium -
envoyBitnami Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null 5.9 Medium -
envoyBitnami Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) 5.9 Medium -
envoyBitnami Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format 7.5 High -
envoyBitnami Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides 5.9 Medium -
envoyBitnami Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream 4.8 Medium -
envoyBitnami Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message 6.5 Medium -
envoyBitnami Envoy Heap Buffer Overflow in TcpStatsdSink 5.9 Medium -
envoyBitnami Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes 6.5 Medium -
envoyBitnami Envoy: Null pointer deref in internal redirects 5.9 Medium -
envoyBitnami Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length 7.5 High -
envoyBitnami Envoy: Abnormal process termination in DNS UDP filter 5.9 Medium -
envoyBitnami Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion 7.5 High -
envoyBitnami Envoy: Stack overflow in destructor of highly nested JSON 7.5 High -
envoyBitnami Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) 4.4 Medium -
envoyBitnami Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption 6.8 Medium -
envoyBitnami Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification 7.5 High -
envoyBitnami Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly 5.3 Medium -
envoyBitnami Envoy HTTP: filter chain execution on reset streams causing UAF crash 5.9 Medium -
envoyBitnami Envoy has an off-by-one write in JsonEscaper::escapeString() 5.3 Medium -
envoyBitnami Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation 7.5 High -
envoyBitnami Crash for scoped ip address in Envoy during DNS 5.9 Medium -
envoyBitnami Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte 5.0 Medium -
envoyBitnami Envoy forwards early CONNECT data in TCP proxy mode 3.7 Low -
envoyBitnami Envoy crashes when JWT authentication is configured with the remote JWKS fetching 6.5 Medium -
envoyBitnami Envoy Lua filter use-after-free when oversized rewritten response body causes crash 6.5 Medium -
envoyBitnami Envoy allows large requests and responses to cause TCP connection pool crash 6.6 Medium -
envoyBitnami Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag 6.3 Medium -
envoyBitnami Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults 7.5 High -
envoyBitnami Envoy vulnerable to bypass of RBAC uri_template permission 5.3 Medium -
envoyBitnami Envoy crashes when HTTP ext_proc processes local replies 6.5 Medium -
envoyBitnami HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy 7.1 High -
envoyBitnami HTTP/1: sending overload crashes when the request is reset beforehand in envoy 7.5 High -
envoyBitnami Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy 4.5 Medium -
envoyBitnami Potential manipulate `x-envoy` headers from external sources in envoy 6.5 Medium -
envoyBitnami oghttp2 crash on OnBeginHeadersForStream in envoy 7.5 High -
envoyBitnami Malicious log injection via access logs in envoy 6.5 Medium -
envoyBitnami Jwt filter crash in the clear route cache with remote JWKs in envoy 5.3 Medium -
envoyBitnami Envoy crashes for LocalReply in http async client 6.5 Medium - Show olderLoading…