Login Request a demo
EN
Product
envoy
by envoyproxy · last CVE Oct 22, 2026
On CISA KEVExploited in the wild
127
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Vulnerabilities127In the news7Timeline
Severity mix
Critical 12High 83Medium 31Low 1
Severity
All severities127Critical12High83Medium31Low1
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add envoy to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-111497
In wildKEVNew
9.8
55%
Oct 22
Out-of-Bounds Write in Google Brotli Decoder
Affected: before 1.37.8; 1.38.0 before 1.38.6; 1.39.0 before 1.39.3
CVE-2019-9901
10.0
5%
Apr 25
Envoy 1.9.0 and before does not normalize HTTP URL paths
Affected: through 1.9.0
CVE-2023-35941
9.8
1%
Jul 25
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: 1.23.0 before 1.23.12; 1.24.0 before 1.24.10; 1.25.0 before 1.25.9; 1.26.0 before 1.26.4
CVE-2023-27488
9.8
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2022-21654
9.8
1%
Feb 22
Envoy is an open source edge and service proxy, designed for cloud-native applications
Affected: 1.7.0 before 1.18.6; 1.19.0 before 1.19.3; 1.20.0 before 1.20.2; 1.21.0 before 1.21.1
CVE-2019-18802
9.8
2%
Dec 13
An issue was discovered in Envoy 1.12.0
Affected: through 1.12.1
CVE-2019-18801
9.8
3%
Dec 13
An issue was discovered in Envoy 1.12.0
Affected: through 1.12.1
CVE-2024-39305
9.1
1%
Jul 1
Envoy is a cloud-native, open source edge and service proxy
Affected: 1.27.6; 1.28.4; 1.29.6; 1.30.3
CVE-2023-27493
9.1
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2023-27491
9.1
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2023-27487
9.1
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2022-29226
9.1
1%
Jun 9
Envoy is a cloud-native high-performance proxy
Affected: before 1.22.1
Showing 12