envoy vulnerabilities | LiveThreat CVE Feed

Product

envoy

by envoyproxy · last CVE Oct 22, 2026

On CISA KEVExploited in the wild

127

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities127 In the news7 Timeline

Severity mix

Critical 12High 83Medium 31Low 1

Severity

All severities127 Critical12 High83 Medium31 Low1

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add envoy to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-34364	6.5	0%	Jun 4	Envoy is a cloud-native, open source edge and service proxy Affected: before 1.27.6; 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2
CVE-2023-35942	6.5	1%	Jul 25	Envoy is an open source edge and service proxy designed for cloud-native applications Affected: 1.23.0 before 1.23.12; 1.24.0 before 1.24.10; 1.25.0 before 1.25.9; 1.26.0 before 1.26.4
CVE-2023-27492	6.5	1%	Apr 4	Envoy is an open source edge and service proxy designed for cloud-native applications Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2022-23606	6.5	1%	Feb 22	Envoy is an open source edge and service proxy, designed for cloud-native applications Affected: 1.20.0 before 1.20.2; 1.21.0
CVE-2022-21657	6.5	1%	Feb 22	Envoy is an open source edge and service proxy, designed for cloud-native applications Affected: before 1.18.6; 1.19.0 before 1.19.3; 1.20.0 before 1.20.2
CVE-2026-48521	5.9	1%	Sep 21	Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1
CVE-2026-50572	5.9	1%	Sep 21	Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1
CVE-2026-48090	5.9	1%	Jun 26	Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5
CVE-2026-47205	5.9	0%	Jun 26	Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9
CVE-2026-26311	5.9	0%	Mar 10	Envoy HTTP: filter chain execution on reset streams causing UAF crash Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13
CVE-2024-34362	5.9	1%	Jun 4	Envoy is a cloud-native, open source edge and service proxy Affected: before 1.27.6; 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2
CVE-2022-29224	5.9	1%	Jun 9	Envoy is a cloud-native high-performance proxy Affected: before 1.22.1
CVE-2022-21656	5.9	1%	Feb 22	Envoy is an open source edge and service proxy, designed for cloud-native applications Affected: before 1.20.2
CVE-2020-15104	5.4	0%	Jul 14	In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to… Affected: before 1.12.6; 1.13.0 before 1.13.4; 1.14.0 before 1.14.4
CVE-2026-73511	5.3	0%	Sep 21	Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1
CVE-2026-73551	5.3	1%	Sep 21	Envoy: Path normalization does not handle dot and dotdot segments with parameters Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1
CVE-2026-73549	5.3	1%	Sep 21	Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1
CVE-2026-26309	5.3	0%	Mar 10	Envoy has an off-by-one write in JsonEscaper::escapeString() Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13
CVE-2025-64763	5.3	0%	Dec 3	Envoy forwards early CONNECT data in TCP proxy mode Affected: >= 1.36.0, <= 1.36.2; >= 1.35.0, <= 1.35.6; >= 1.34.0, <= 1.34.10; <= 1.33.12
CVE-2025-46821	5.3	0%	May 7	Envoy is a cloud-native edge/middle/service proxy Affected: before 1.31.8; 1.32.0 before 1.32.6; 1.33.0 before 1.33.3; 1.34.0
CVE-2024-23323	5.3	1%	Feb 9	Envoy is a high-performance edge/middle/service proxy Affected: 1.26.0 before 1.26.7; 1.27.0 before 1.27.3; 1.28.0 before 1.28.1; 1.29.0 before 1.29.1
CVE-2023-35944	5.3	1%	Jul 25	Envoy is an open source edge and service proxy designed for cloud-native applications Affected: 1.23.0 before 1.23.12; 1.24.0 before 1.24.10; 1.25.0 before 1.25.9; 1.26.0 before 1.26.4
CVE-2020-8660	5.3	1%	Mar 4	CNCF Envoy through 1.13.0 TLS inspector bypass Affected: before 1.12.3; 1.13.0 before 1.13.1
CVE-2020-8664	5.3	1%	Mar 4	CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context Affected: through 1.13.0
CVE-2026-47778	4.4	0%	Jun 26	Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11
CVE-2026-47692	4.3	0%	Jun 26	Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.34.0, < 1.35.13
CVE-2020-11767	3.1	2%	Apr 15	Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue Affected: through 1.14.1