Skip to content
Envoyproxy vulnerabilities
Newest
-
envoyproxy envoy
Envoy: RBAC Authorization Bypass via Path Parameters
CVE-2026-73553
Fix available
7.5 High
-
envoyproxy envoy
Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
CVE-2026-73552
Fix available
7.5 High
-
envoyproxy envoy
Envoy: Path normalization does not handle dot and dotdot segments with parameters
CVE-2026-73551
Fix available
5.3 Medium
-
envoyproxy envoy
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
CVE-2026-73550
Fix available
7.5 High
-
envoyproxy envoy
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
CVE-2026-73549
Fix available
5.3 Medium
-
envoyproxy envoy
Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
CVE-2026-73548
Fix available
7.5 High
-
envoyproxy envoy
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
CVE-2026-73547
Fix available
7.5 High
-
envoyproxy envoy
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
CVE-2026-73546
Fix available
7.4 High
-
envoyproxy envoy
Envoy: oghttp2 upstream trailers incorrect handling
CVE-2026-73513
Fix available
7.5 High
-
envoyproxy envoy
Envoy: use-after-free in QUIC on internal redirects
CVE-2026-73512
Fix available
7.5 High
-
envoyproxy envoy
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
CVE-2026-73511
Fix available
5.3 Medium
-
envoyproxy envoy
Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
CVE-2026-50572
Fix available
5.9 Medium
-
envoyproxy envoy
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
CVE-2026-48521
Fix available
5.9 Medium
-
envoyproxy gateway
Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
CVE-2026-53714
Fix available
7.4 High
-
envoyproxy gateway
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
CVE-2026-53713
Fix available
9.1 Critical
-
envoyproxy gateway
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
CVE-2026-53715
Fix available
5.3 Medium
-
envoyproxy gateway
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
CVE-2026-53717
Fix available
6.5 Medium
-
envoyproxy gateway
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
CVE-2026-53719
Fix available
6.5 Medium
-
envoyproxy gateway
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
CVE-2026-53716
Fix available
6.5 Medium
-
envoyproxy gateway
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
CVE-2026-53718
Fix available
6.4 Medium
-
envoyproxy envoy
Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)
CVE-2026-48090
Fix available
5.9 Medium
-
envoyproxy envoy, red hat openshift service mesh 2, openshift service mesh 3 +2 more
Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format
CVE-2026-47220
Fix available
7.5 High
-
envoyproxy envoy
Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides
CVE-2026-47205
Fix available
5.9 Medium
-
envoyproxy envoy
Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
CVE-2026-47692
Fix available
4.8 Medium
-
envoyproxy envoy
Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message
CVE-2026-47207
Fix available
6.5 Medium
-
envoyproxy envoy
Envoy Heap Buffer Overflow in TcpStatsdSink
CVE-2026-48706
Fix available
5.9 Medium
-
envoyproxy envoy
Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
CVE-2026-47204
Fix available
6.5 Medium
-
envoyproxy envoy
Envoy: Null pointer deref in internal redirects
CVE-2026-47221
Fix available
5.9 Medium
-
envoyproxy envoy
Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length
CVE-2026-48743
Fix available
7.5 High
-
envoyproxy envoy
Envoy: Abnormal process termination in DNS UDP filter
CVE-2026-48497
Fix available
5.9 Medium
-
envoyproxy envoy
Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
CVE-2026-48044
Fix available
7.5 High
-
envoyproxy envoy
Envoy: Stack overflow in destructor of highly nested JSON
CVE-2026-48042
Fix available
7.5 High
-
envoyproxy envoy
Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
CVE-2026-47778
Fix available
4.4 Medium
-
envoyproxy envoy
Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption
CVE-2026-47775
Fix available
6.8 Medium
-
envoyproxy envoy, red hat openshift service mesh 2.6, openshift service mesh 3.0 +4 more +6 more
Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
CVE-2026-47774
Fix available
7.5 High
-
andybalholm brotli, 7-zip p7zip, anthropic bun +34 more +36 more
Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-111497
In KEVPublic exploitFix available
EPSS 82.6%
9.2 Critical
-
envoyproxy envoy
Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly
CVE-2026-26330
Fix available
5.3 Medium
-
envoyproxy envoy
Envoy HTTP: filter chain execution on reset streams causing UAF crash
CVE-2026-26311
Fix available
5.9 Medium
-
envoyproxy envoy
Envoy has an off-by-one write in JsonEscaper::escapeString()
CVE-2026-26309
Fix available
5.3 Medium
-
envoyproxy envoy
Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation
CVE-2026-26308
Fix available
7.5 High
-
envoyproxy envoy
Crash for scoped ip address in Envoy during DNS
CVE-2026-26310
Fix available
5.9 Medium
-
envoyproxy gateway, red hat connectivity link 1 +1 more
Envoy Extension Policy lua scripts injection causes arbitrary command execution
CVE-2026-22771
Fix available
8.8 High
-
envoyproxy envoy
Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
CVE-2025-66220
Fix available
5.0 Medium
-
envoyproxy envoy
Envoy forwards early CONNECT data in TCP proxy mode
CVE-2025-64763
Fix available
3.7 Low
-
envoyproxy envoy
Envoy crashes when JWT authentication is configured with the remote JWKS fetching
CVE-2025-64527
Fix available
6.5 Medium
-
envoyproxy envoy
Envoy Lua filter use-after-free when oversized rewritten response body causes crash
CVE-2025-62504
Fix available
6.5 Medium
-
envoyproxy envoy
Envoy allows large requests and responses to cause TCP connection pool crash
CVE-2025-62409
Fix available
6.6 Medium
-
envoyproxy envoy
Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag
CVE-2025-55162
Fix available
6.3 Medium
-
envoyproxy envoy
Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults
CVE-2025-54588
Fix available
7.5 High
-
envoyproxy envoy
Envoy vulnerable to bypass of RBAC uri_template permission
CVE-2025-46821
Fix available
5.3 Medium
- Show olderLoading…