envoy
by Envoy
Source repositories
CVEs (77)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-18802 | Cri | 0.64 | 9.8 | 0.02 | Dec 13, 2019 | An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one… | ||
| CVE-2019-18801 | Cri | 0.64 | 9.8 | 0.03 | Dec 13, 2019 | An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used… | ||
| CVE-2021-29492 | Hig | 0.58 | 8.1 | 0.68 | May 28, 2021 | Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control,… | ||
| CVE-2024-21881 | Hig | 0.56 | — | 0.00 | Aug 12, 2024 | Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x | ||
| CVE-2023-35941 | Hig | 0.56 | 8.6 | 0.01 | Jul 25, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the… | ||
| CVE-2021-32781 | Hig | 0.56 | 8.6 | 0.01 | Aug 24, 2021 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is… | ||
| CVE-2021-32780 | Hig | 0.56 | 8.6 | 0.01 | Aug 24, 2021 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is… | ||
| CVE-2021-32779 | Hig | 0.56 | 8.6 | 0.01 | Aug 24, 2021 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or… | ||
| CVE-2021-32777 | Hig | 0.56 | 8.6 | 0.03 | Aug 24, 2021 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the… | ||
| CVE-2020-25017 | Hig | 0.54 | 8.3 | 0.01 | Oct 1, 2020 | Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header. | ||
| CVE-2023-35944 | Hig | 0.53 | 8.2 | 0.01 | Jul 25, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the… | ||
| CVE-2023-27493 | Hig | 0.53 | 8.1 | 0.01 | Apr 4, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal… | ||
| CVE-2023-27487 | Hig | 0.53 | 8.2 | 0.01 | Apr 4, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an… | ||
| CVE-2026-73547 | imp | 0.49 | 7.5 | — | Aug 26, 2026 | envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header | ||
| CVE-2026-73550 | imp | 0.49 | 7.5 | — | Aug 26, 2026 | envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits | ||
| CVE-2026-73548 | imp | 0.49 | 7.5 | — | Aug 26, 2026 | envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests | ||
| CVE-2026-73513 | imp | 0.49 | 7.5 | — | Aug 26, 2026 | envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free | ||
| CVE-2026-73553 | imp | 0.49 | 7.5 | — | Aug 26, 2026 | envoy: envoy: RBAC authorization bypass when path-parameter stripping is enabled | ||
| CVE-2026-73552 | imp | 0.49 | 7.5 | — | Aug 26, 2026 | envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values | ||
| CVE-2026-73512 | imp | 0.49 | 7.5 | — | Aug 26, 2026 | envoy: envoy: HTTP/3 use-after-free when processing late datagrams |
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one…
- risk 0.64cvss 9.8epss 0.03
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used…
- risk 0.58cvss 8.1epss 0.68
Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control,…
- risk 0.56cvss —epss 0.00
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x
- risk 0.56cvss 8.6epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the…
- risk 0.56cvss 8.6epss 0.01
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is…
- risk 0.56cvss 8.6epss 0.01
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is…
- risk 0.56cvss 8.6epss 0.01
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or…
- risk 0.56cvss 8.6epss 0.03
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the…
- risk 0.54cvss 8.3epss 0.01
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
- risk 0.53cvss 8.2epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the…
- risk 0.53cvss 8.1epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal…
- risk 0.53cvss 8.2epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an…
- risk 0.49cvss 7.5epss —
envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header
- risk 0.49cvss 7.5epss —
envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits
- risk 0.49cvss 7.5epss —
envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests
- risk 0.49cvss 7.5epss —
envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free
- risk 0.49cvss 7.5epss —
envoy: envoy: RBAC authorization bypass when path-parameter stripping is enabled
- risk 0.49cvss 7.5epss —
envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values
- risk 0.49cvss 7.5epss —
envoy: envoy: HTTP/3 use-after-free when processing late datagrams
Page 1 of 4