Login Request a demo
EN
Vendor
envoyproxy
2 products with CVEs on record
136
CVEs
1
On KEV
0
New 30D
Products
EN
envoy
envoyproxy
10.0
126 CVEs1 on KEV0 new
GA
gateway
envoyproxy
9.1
10 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-73511
EN
envoy
envoyproxy
5.3
0%
Sep 21Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
CVE-2026-73553
EN
envoy
envoyproxy
7.5
1%
Sep 21Envoy: RBAC Authorization Bypass via Path Parameters
CVE-2026-73551
EN
envoy
envoyproxy
5.3
1%
Sep 21Envoy: Path normalization does not handle dot and dotdot segments with parameters
CVE-2026-73546
EN
envoy
envoyproxy
7.4
1%
Sep 21Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
CVE-2026-73512
EN
envoy
envoyproxy
7.5
1%
Sep 21Envoy: use-after-free in QUIC on internal redirects
CVE-2026-73550
EN
envoy
envoyproxy
7.5
1%
Sep 21Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
CVE-2026-73547
EN
envoy
envoyproxy
7.5
1%
Sep 21Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
CVE-2026-48521
EN
envoy
envoyproxy
5.9
1%
Sep 21Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
CVE-2026-73549
EN
envoy
envoyproxy
5.3
1%
Sep 21Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
CVE-2026-73513
EN
envoy
envoyproxy
7.5
0%
Sep 21Envoy: oghttp2 upstream trailers incorrect handling
CVE-2026-73552
EN
envoy
envoyproxy
7.5
0%
Sep 21Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
CVE-2026-73548
EN
envoy
envoyproxy
7.5
0%
Sep 21Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
CVE-2026-50572
EN
envoy
envoyproxy
5.9
1%
Sep 21Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
CVE-2026-53714
GA
gateway
envoyproxy
7.4
0%
Sep 14Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
CVE-2026-53716
GA
gateway
envoyproxy
6.5
1%
Sep 14Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
CVE-2026-53715
GA
gateway
envoyproxy
5.3
0%
Sep 14Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
CVE-2026-53719
GA
gateway
envoyproxy
6.5
1%
Sep 14Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
CVE-2026-53718
GA
gateway
envoyproxy
6.4
0%
Sep 14Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
CVE-2026-53713
GA
gateway
envoyproxy
9.1
0%
Sep 14Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
CVE-2026-53717
GA
gateway
envoyproxy
6.5
1%
Sep 14Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
CVE-2026-48090
EN
envoy
envoyproxy
5.9
1%
Jun 26Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)
CVE-2026-47220
EN
envoy
envoyproxy
7.5
1%
Jun 26Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format
CVE-2026-47205
EN
envoy
envoyproxy
5.9
0%
Jun 26Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides
CVE-2026-47692
EN
envoy
envoyproxy
4.3
0%
Jun 26Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
CVE-2026-47207
EN
envoy
envoyproxy
6.5
0%
Jun 26Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message
CVE-2026-48706
EN
envoy
envoyproxy
7.5
1%
Jun 26Envoy Heap Buffer Overflow in TcpStatsdSink
CVE-2026-47204
EN
envoy
envoyproxy
7.5
0%
Jun 26Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
CVE-2026-47221
EN
envoy
envoyproxy
7.5
0%
Jun 26Envoy: Null pointer deref in internal redirects
CVE-2026-48743
EN
envoy
envoyproxy
7.5
0%
Jun 26Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length
CVE-2026-48497
EN
envoy
envoyproxy
7.5
0%
Jun 26Envoy: Abnormal process termination in DNS UDP filter
CVE-2026-48044
EN
envoy
envoyproxy
7.5
0%
Jun 26Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
CVE-2026-48042
EN
envoy
envoyproxy
7.5
1%
Jun 26Envoy: Stack overflow in destructor of highly nested JSON
CVE-2026-47778
EN
envoy
envoyproxy
4.4
0%
Jun 26Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
CVE-2026-47775
EN
envoy
envoyproxy
6.8
0%
Jun 26Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption
CVE-2026-47774
EN
envoy
envoyproxy
7.5
1%
Jun 17Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
CVE-2026-26330
EN
envoy
envoyproxy
7.5
0%
Mar 10Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly
CVE-2026-26311
EN
envoy
envoyproxy
5.9
0%
Mar 10Envoy HTTP: filter chain execution on reset streams causing UAF crash
CVE-2026-26310
EN
envoy
envoyproxy
7.5
0%
Mar 10Crash for scoped ip address in Envoy during DNS
CVE-2026-26309
EN
envoy
envoyproxy
5.3
0%
Mar 10Envoy has an off-by-one write in JsonEscaper::escapeString()
CVE-2026-26308
EN
envoy
envoyproxy
8.2
0%
Mar 10Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation
CVE-2026-22771
GA
gateway
envoyproxy
8.8
1%
Jan 12Envoy Extension Policy lua scripts injection causes arbitrary command execution
CVE-2025-66220
EN
envoy
envoyproxy
7.1
0%
Dec 3Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
CVE-2025-64763
EN
envoy
envoyproxy
5.3
0%
Dec 3Envoy forwards early CONNECT data in TCP proxy mode
CVE-2025-64527
EN
envoy
envoyproxy
6.5
1%
Dec 3Envoy crashes when JWT authentication is configured with the remote JWKS fetching
CVE-2025-62504
EN
Envoy
Envoyproxy
7.5
0%
Oct 16Envoy is an open source edge and service proxy
CVE-2025-62409
EN
Envoy
Envoyproxy
7.5
0%
Oct 16Envoy is a cloud-native, open source edge and service proxy
CVE-2025-55162
EN
Envoy
Envoyproxy
8.8
0%
Sep 3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures
CVE-2025-54588
EN
Envoy
Envoyproxy
7.5
0%
Sep 3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures
CVE-2025-46821
EN
Envoy
Envoyproxy
5.3
0%
May 7Envoy is a cloud-native edge/middle/service proxy
CVE-2025-30157
EN
Envoy
Envoyproxy
7.5
0%
Mar 21Envoy is a cloud-native high-performance edge/middle/service proxy
CVE-2025-25294
GA
Gateway
Envoyproxy
5.3
0%
Mar 6Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2025-24030
GA
Gateway
Envoyproxy
7.1
0%
Jan 23Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
CVE-2024-53271
EN
envoy
envoyproxy
7.1
1%
Dec 18HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy
CVE-2024-53270
EN
envoy
envoyproxy
7.5
1%
Dec 18HTTP/1: sending overload crashes when the request is reset beforehand in envoy
CVE-2024-53269
EN
envoy
envoyproxy
7.5
1%
Dec 18Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy
CVE-2024-45810
EN
Envoy
Envoyproxy
7.5
1%
Sep 20Envoy is a cloud-native high-performance edge/middle/service proxy
CVE-2024-45809
EN
Envoy
Envoyproxy
7.5
0%
Sep 20Envoy is a cloud-native high-performance edge/middle/service proxy
CVE-2024-45808
EN
Envoy
Envoyproxy
6.5
0%
Sep 20Envoy is a cloud-native high-performance edge/middle/service proxy
CVE-2024-45807
EN
Envoy
Envoyproxy
7.5
0%
Sep 20Envoy is a cloud-native high-performance edge/middle/service proxy
CVE-2024-45806
EN
Envoy
Envoyproxy
6.5
0%
Sep 20Envoy is a cloud-native high-performance edge/middle/service proxy