EN
Product
envoy
On CISA KEVExploited in the wild
127
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 12High 83Medium 31Low 1
Watch
Add envoy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: 1.24.10; 1.25.9; 1.26.4; 1.27.0 |
| CVE-2025-55162 | 8.8 | Sep 3 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: before 1.32.10; 1.33.0 through 1.33.7; 1.34.0 before 1.34.5; 1.35.0 |
| CVE-2020-35470 | 8.8 | Dec 15 | Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header Affected: before 1.16.1 |
| CVE-2021-39206 | 8.6 | Sep 9 | Pomerium is an open source identity-aware access proxy Affected: before 1.16.5; 1.17.0 before 1.17.4; 1.18.0 before 1.18.4; 1.19.0 |
| CVE-2021-39162 | 8.6 | Sep 9 | Pomerium is an open source identity-aware access proxy Affected: before 1.18.4; 1.19.0 |
| CVE-2021-32779 | 8.3 | Aug 24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: 1.16.0 before 1.16.5; 1.17.0 before 1.17.4; 1.18.0 before 1.18.4; 1.19.0 |
| CVE-2021-32777 | 8.3 | Aug 24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: 1.16.0 before 1.16.5; 1.17.0 before 1.17.4; 1.18.0 before 1.18.4; 1.19.0 |
| CVE-2021-29492 | 8.3 | May 28 | Envoy is a cloud-native edge/middle/service proxy Affected: before 1.15.5; 1.16.0 before 1.16.4; 1.17.0 before 1.17.3; 1.18.0 before 1.18.3 |
| CVE-2020-25017 | 8.3 | Oct 1 | Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers Affected: before 1.12.7; 1.13.0 before 1.13.4; 1.14.0 before 1.14.4; 1.15.0 before 1.15.1 |
| CVE-2019-9900 | 8.3 | Apr 25 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0) Affected: through 1.9.0 |
| CVE-2026-26308 | 8.2 | Mar 10 | Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2024-23326 | 8.2 | Jun 4 | Envoy is a cloud-native, open source edge and service proxy Affected: before 1.27.6; 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2 |
| CVE-2021-21378 | 8.2 | Mar 11 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: 1.17.0 |
| CVE-2026-73553 | 7.5 | Sep 21 | Envoy: RBAC Authorization Bypass via Path Parameters Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73512 | 7.5 | Sep 21 | Envoy: use-after-free in QUIC on internal redirects Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73550 | 7.5 | Sep 21 | Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73547 | 7.5 | Sep 21 | Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73513 | 7.5 | Sep 21 | Envoy: oghttp2 upstream trailers incorrect handling Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73552 | 7.5 | Sep 21 | Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73548 | 7.5 | Sep 21 | Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-47220 | 7.5 | Jun 26 | Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5 |
| CVE-2026-48706 | 7.5 | Jun 26 | Envoy Heap Buffer Overflow in TcpStatsdSink Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.34.0, < 1.35.13 |
| CVE-2026-47204 | 7.5 | Jun 26 | Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.26.0, < 1.35.13 |
| CVE-2026-47221 | 7.5 | Jun 26 | Envoy: Null pointer deref in internal redirects Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.18.0, < 1.35.13 |
| CVE-2026-48743 | 7.5 | Jun 26 | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; >= 1.35.0, < 1.35.11 |
| CVE-2026-48497 | 7.5 | Jun 26 | Envoy: Abnormal process termination in DNS UDP filter Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11 |
| CVE-2026-48044 | 7.5 | Jun 26 | Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; >= 1.23.0, < 1.35.11 |
| CVE-2026-48042 | 7.5 | Jun 26 | Envoy: Stack overflow in destructor of highly nested JSON Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11 |
| CVE-2026-47774 | 7.5 | Jun 17 | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification Affected: < 1.35.11; >= 1.36.0, < 1.36.7; >= 1.37.0, < 1.37.3; >= 1.38.0, < 1.38.1 |
| CVE-2026-26330 | 7.5 | Mar 10 | Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2026-26310 | 7.5 | Mar 10 | Crash for scoped ip address in Envoy during DNS Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2025-62504 | 7.5 | Oct 16 | Envoy is an open source edge and service proxy Affected: before 1.33.12; 1.34.0 before 1.34.10; 1.35.0 before 1.35.6; 1.36.0 before 1.36.2 |
| CVE-2025-62409 | 7.5 | Oct 16 | Envoy is a cloud-native, open source edge and service proxy Affected: before 1.33.11; 1.34.0 before 1.34.9; 1.35.0 before 1.35.5; 1.36.0 |
| CVE-2025-54588 | 7.5 | Sep 3 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures Affected: 1.34.0 before 1.34.5; 1.35.0 |
| CVE-2025-30157 | 7.5 | Mar 21 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: before 1.30.10; 1.31.0 before 1.31.6; 1.32.0 before 1.32.4; 1.33.0 |
| CVE-2024-53270 | 7.5 | Dec 18 | HTTP/1: sending overload crashes when the request is reset beforehand in envoy Affected: >= 1.32.0, < 1.32.3; >= 1.31.0, < 1.31.5; >= 1.30.0, < 1.30.9; < 1.29.12 |
| CVE-2024-53269 | 7.5 | Dec 18 | Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy Affected: >= 1.32.0, < 1.32.2; >= 1.31.0, < 1.31.4; >= 1.30.0, < 1.30.8 |
| CVE-2024-45810 | 7.5 | Sep 20 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: before 1.28.7; 1.29.0 before 1.29.9; 1.30.0 before 1.30.6; 1.31.0 before 1.31.2 |
| CVE-2024-45809 | 7.5 | Sep 20 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: 1.29.0 before 1.29.9; 1.30.0 before 1.30.6; 1.31.0 before 1.31.2 |
| CVE-2024-45807 | 7.5 | Sep 20 | Envoy is a cloud-native high-performance edge/middle/service proxy Affected: 1.31.0 before 1.31.2 |
| CVE-2024-34363 | 7.5 | Jun 4 | Envoy is a cloud-native, open source edge and service proxy Affected: 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2 |
| CVE-2024-32976 | 7.5 | Jun 4 | Envoy is a cloud-native, open source edge and service proxy Affected: 1.18.0 before 1.27.6; 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2 |
| CVE-2024-32975 | 7.5 | Jun 4 | Envoy is a cloud-native, open source edge and service proxy Affected: before 1.27.6; 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2 |
| CVE-2024-32974 | 7.5 | Jun 4 | Envoy is a cloud-native, open source edge and service proxy Affected: before 1.27.6; 1.28.0 before 1.28.4; 1.29.0 before 1.29.5; 1.30.0 before 1.30.2 |
| CVE-2024-32475 | 7.5 | Apr 18 | Envoy is a cloud-native, open source edge and service proxy Affected: 1.13.0 before 1.27.5; 1.28.0 before 1.28.3; 1.29.0 before 1.29.4; 1.30.0 |
| CVE-2024-30255 | 7.5 | Apr 4 | Envoy is a cloud-native, open source edge and service proxy Affected: before 1.26.8; 1.27.0 before 1.27.4; 1.28.0 before 1.28.2; 1.29.0 before 1.29.3 |
| CVE-2024-27919 | 7.5 | Apr 4 | Envoy is a cloud-native, open-source edge and service proxy Affected: 1.29.0; 1.29.1 |
| CVE-2024-23327 | 7.5 | Feb 9 | Envoy is a high-performance edge/middle/service proxy Affected: 1.26.0 before 1.26.7; 1.27.0 before 1.27.3; 1.28.0 before 1.28.1; 1.29.0 before 1.29.1 |
| CVE-2024-23325 | 7.5 | Feb 9 | Envoy is a high-performance edge/middle/service proxy Affected: 1.26.0 before 1.26.7; 1.27.0 before 1.27.3; 1.28.0 before 1.28.1; 1.29.0 before 1.29.1 |
| CVE-2024-23324 | 7.5 | Feb 9 | Envoy is a high-performance edge/middle/service proxy Affected: 1.26.0 before 1.26.7; 1.27.0 before 1.27.3; 1.28.0 before 1.28.1; 1.29.0 before 1.29.1 |