EN
Product
envoy
On CISA KEVExploited in the wild
127
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 12High 83Medium 31Low 1
Watch
Add envoy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111497 In wildKEVNew | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder Affected: before 1.37.8; 1.38.0 before 1.38.6; 1.39.0 before 1.39.3 |
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: 1.24.10; 1.25.9; 1.26.4; 1.27.0 |
| CVE-2019-9901 | 10.0 | Apr 25 | Envoy 1.9.0 and before does not normalize HTTP URL paths Affected: through 1.9.0 |
| CVE-2023-35941 | 9.8 | Jul 25 | Envoy is an open source edge and service proxy designed for cloud-native applications Affected: 1.23.0 before 1.23.12; 1.24.0 before 1.24.10; 1.25.0 before 1.25.9; 1.26.0 before 1.26.4 |
| CVE-2023-27488 | 9.8 | Apr 4 | Envoy is an open source edge and service proxy designed for cloud-native applications Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3 |
| CVE-2022-21654 | 9.8 | Feb 22 | Envoy is an open source edge and service proxy, designed for cloud-native applications Affected: 1.7.0 before 1.18.6; 1.19.0 before 1.19.3; 1.20.0 before 1.20.2; 1.21.0 before 1.21.1 |
| CVE-2019-18802 | 9.8 | Dec 13 | An issue was discovered in Envoy 1.12.0 Affected: through 1.12.1 |
| CVE-2019-18801 | 9.8 | Dec 13 | An issue was discovered in Envoy 1.12.0 Affected: through 1.12.1 |
| CVE-2024-39305 | 9.1 | Jul 1 | Envoy is a cloud-native, open source edge and service proxy Affected: 1.27.6; 1.28.4; 1.29.6; 1.30.3 |
| CVE-2023-27493 | 9.1 | Apr 4 | Envoy is an open source edge and service proxy designed for cloud-native applications Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3 |
| CVE-2023-27491 | 9.1 | Apr 4 | Envoy is an open source edge and service proxy designed for cloud-native applications Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3 |
| CVE-2023-27487 | 9.1 | Apr 4 | Envoy is an open source edge and service proxy designed for cloud-native applications Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3 |
| CVE-2022-29226 | 9.1 | Jun 9 | Envoy is a cloud-native high-performance proxy Affected: before 1.22.1 |
| CVE-2025-55162 | 8.8 | Sep 3 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: before 1.32.10; 1.33.0 through 1.33.7; 1.34.0 before 1.34.5; 1.35.0 |
| CVE-2020-35470 | 8.8 | Dec 15 | Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header Affected: before 1.16.1 |
| CVE-2021-39206 | 8.6 | Sep 9 | Pomerium is an open source identity-aware access proxy Affected: before 1.16.5; 1.17.0 before 1.17.4; 1.18.0 before 1.18.4; 1.19.0 |
| CVE-2021-39162 | 8.6 | Sep 9 | Pomerium is an open source identity-aware access proxy Affected: before 1.18.4; 1.19.0 |
| CVE-2021-32779 | 8.3 | Aug 24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: 1.16.0 before 1.16.5; 1.17.0 before 1.17.4; 1.18.0 before 1.18.4; 1.19.0 |
| CVE-2021-32777 | 8.3 | Aug 24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: 1.16.0 before 1.16.5; 1.17.0 before 1.17.4; 1.18.0 before 1.18.4; 1.19.0 |
| CVE-2021-29492 | 8.3 | May 28 | Envoy is a cloud-native edge/middle/service proxy Affected: before 1.15.5; 1.16.0 before 1.16.4; 1.17.0 before 1.17.3; 1.18.0 before 1.18.3 |
| CVE-2020-25017 | 8.3 | Oct 1 | Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers Affected: before 1.12.7; 1.13.0 before 1.13.4; 1.14.0 before 1.14.4; 1.15.0 before 1.15.1 |
| CVE-2019-9900 | 8.3 | Apr 25 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0) Affected: through 1.9.0 |
| CVE-2026-26308 | 8.2 | Mar 10 | Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2024-23326 | 8.2 | Jun 4 | Envoy is a cloud-native, open source edge and service proxy Affected: before 1.27.6; 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2 |
| CVE-2021-21378 | 8.2 | Mar 11 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: 1.17.0 |
| CVE-2026-73553 | 7.5 | Sep 21 | Envoy: RBAC Authorization Bypass via Path Parameters Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73512 | 7.5 | Sep 21 | Envoy: use-after-free in QUIC on internal redirects Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73550 | 7.5 | Sep 21 | Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73547 | 7.5 | Sep 21 | Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73513 | 7.5 | Sep 21 | Envoy: oghttp2 upstream trailers incorrect handling Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73552 | 7.5 | Sep 21 | Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73548 | 7.5 | Sep 21 | Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-47220 | 7.5 | Jun 26 | Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5 |
| CVE-2026-48706 | 7.5 | Jun 26 | Envoy Heap Buffer Overflow in TcpStatsdSink Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.34.0, < 1.35.13 |
| CVE-2026-47204 | 7.5 | Jun 26 | Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.26.0, < 1.35.13 |
| CVE-2026-47221 | 7.5 | Jun 26 | Envoy: Null pointer deref in internal redirects Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.18.0, < 1.35.13 |
| CVE-2026-48743 | 7.5 | Jun 26 | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; >= 1.35.0, < 1.35.11 |
| CVE-2026-48497 | 7.5 | Jun 26 | Envoy: Abnormal process termination in DNS UDP filter Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11 |
| CVE-2026-48044 | 7.5 | Jun 26 | Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; >= 1.23.0, < 1.35.11 |
| CVE-2026-48042 | 7.5 | Jun 26 | Envoy: Stack overflow in destructor of highly nested JSON Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11 |
| CVE-2026-47774 | 7.5 | Jun 17 | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification Affected: < 1.35.11; >= 1.36.0, < 1.36.7; >= 1.37.0, < 1.37.3; >= 1.38.0, < 1.38.1 |
| CVE-2026-26330 | 7.5 | Mar 10 | Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2026-26310 | 7.5 | Mar 10 | Crash for scoped ip address in Envoy during DNS Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2025-62504 | 7.5 | Oct 16 | Envoy Lua filter use-after-free when oversized rewritten response body causes crash Affected: >= 1.36.0, <= 1.36.1; >= 1.350, <= 1.35.5; >= 1.34.0, <= 1.34.9; <= 1.33.11 |
| CVE-2025-62409 | 7.5 | Oct 16 | Envoy allows large requests and responses to cause TCP connection pool crash Affected: >= 1.36.0, < 1.36.1; >= 1.35.0, < 1.35.5; >= 1.34.0, < 1.34.9; < 1.33.10 |
| CVE-2025-54588 | 7.5 | Sep 3 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: 1.34.0 before 1.34.5; 1.35.0 |
| CVE-2025-30157 | 7.5 | Mar 21 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: before 1.30.10; 1.31.0 before 1.31.6; 1.32.0 before 1.32.4; 1.33.0 |
| CVE-2024-53270 | 7.5 | Dec 18 | HTTP/1: sending overload crashes when the request is reset beforehand in envoy Affected: >= 1.32.0, < 1.32.3; >= 1.31.0, < 1.31.5; >= 1.30.0, < 1.30.9; < 1.29.12 |
| CVE-2024-53269 | 7.5 | Dec 18 | Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy Affected: >= 1.32.0, < 1.32.2; >= 1.31.0, < 1.31.4; >= 1.30.0, < 1.30.8 |
| CVE-2024-45810 | 7.5 | Sep 20 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: before 1.28.7; 1.29.0 before 1.29.9; 1.30.0 before 1.30.6; 1.31.0 before 1.31.2 |