envoy
by Envoy
Source repositories
CVEs (77)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-35942 | Med | 0.42 | 6.5 | 0.01 | Jul 25, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions… | ||
| CVE-2023-27496 | Med | 0.42 | 6.5 | 0.01 | Apr 4, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redirect response. Sending… | ||
| CVE-2021-29258 | Hig | 0.42 | 7.5 | 0.02 | May 20, 2021 | An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion. | ||
| CVE-2025-55162 | Med | 0.41 | 6.3 | 0.00 | Sep 3, 2025 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed… | ||
| CVE-2023-35943 | Med | 0.41 | 6.3 | 0.01 | Jul 25, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and… | ||
| CVE-2026-48521 | mod | 0.38 | 5.9 | — | Aug 26, 2026 | envoy: envoy: HTTP/3 null transport socket options dereference during connection-pool selection | ||
| CVE-2026-50572 | mod | 0.38 | 5.9 | — | Aug 26, 2026 | envoy: envoy: ext_authz use-after-free after rejecting an HTTP request | ||
| CVE-2024-32974 | Med | 0.38 | 5.9 | 0.01 | Jun 4, 2024 | Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the… | ||
| CVE-2021-32778 | Med | 0.38 | 5.8 | 0.01 | Aug 24, 2021 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are… | ||
| CVE-2026-47204 | Med | 0.35 | 6.5 | 0.00 | Jun 26, 2026 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type:… | ||
| CVE-2023-27491 | Med | 0.35 | 5.4 | 0.01 | Apr 4, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow… | ||
| CVE-2023-27488 | Med | 0.35 | 5.4 | 0.01 | Apr 4, 2023 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components… | ||
| CVE-2026-73551 | mod | 0.34 | 5.3 | — | Aug 26, 2026 | envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters | ||
| CVE-2026-73511 | mod | 0.34 | 5.3 | — | Aug 26, 2026 | envoy: envoy: path matching bypass via per-segment parameters not stripped by router | ||
| CVE-2026-73549 | mod | 0.34 | 5.3 | — | Aug 26, 2026 | envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters | ||
| CVE-2026-6994 | Med | 0.34 | 6.3 | 0.00 | Apr 25, 2026 | A weakness has been identified in Envoy up to 1.33.0. Affected is the function params.add of the file source/extensions/filters/http/header_mutation/header_mutation.cc of the component Query Parameter Handler. This manipulation causes injection. Remote exploitation of the attack… | ||
| CVE-2025-46821 | Med | 0.34 | 5.3 | 0.00 | May 7, 2025 | Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not… | ||
| CVE-2024-45809 | Med | 0.34 | 5.3 | 0.00 | Sep 20, 2024 | Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the… | ||
| CVE-2026-47221 | Med | 0.31 | 5.9 | 0.00 | Jun 26, 2026 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less… | ||
| CVE-2024-23326 | Med | 0.31 | 5.9 | 0.00 | Jun 4, 2024 | Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101… |
- risk 0.42cvss 6.5epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions…
- risk 0.42cvss 6.5epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redirect response. Sending…
- risk 0.42cvss 7.5epss 0.02
An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.
- risk 0.41cvss 6.3epss 0.00
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed…
- risk 0.41cvss 6.3epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and…
- risk 0.38cvss 5.9epss —
envoy: envoy: HTTP/3 null transport socket options dereference during connection-pool selection
- risk 0.38cvss 5.9epss —
envoy: envoy: ext_authz use-after-free after rejecting an HTTP request
- risk 0.38cvss 5.9epss 0.01
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the…
- risk 0.38cvss 5.8epss 0.01
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are…
- risk 0.35cvss 6.5epss 0.00
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type:…
- risk 0.35cvss 5.4epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow…
- risk 0.35cvss 5.4epss 0.01
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components…
- risk 0.34cvss 5.3epss —
envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters
- risk 0.34cvss 5.3epss —
envoy: envoy: path matching bypass via per-segment parameters not stripped by router
- risk 0.34cvss 5.3epss —
envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters
- risk 0.34cvss 6.3epss 0.00
A weakness has been identified in Envoy up to 1.33.0. Affected is the function params.add of the file source/extensions/filters/http/header_mutation/header_mutation.cc of the component Query Parameter Handler. This manipulation causes injection. Remote exploitation of the attack…
- risk 0.34cvss 5.3epss 0.00
Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not…
- risk 0.34cvss 5.3epss 0.00
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the…
- risk 0.31cvss 5.9epss 0.00
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less…
- risk 0.31cvss 5.9epss 0.00
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101…
Page 3 of 4