Login Request a demo
EN
Product
envoy
by envoyproxy · last CVE Oct 22, 2026
On CISA KEVExploited in the wild
127
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Vulnerabilities127In the news8Timeline
Severity mix
Critical 12High 83Medium 31Low 1
Severity
All severities127Critical12High83Medium31Low1
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add envoy to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-111497
In wildKEV
9.8
88%
Oct 22
Out-of-Bounds Write in Google Brotli Decoder
Affected: before 1.37.8; 1.38.0 before 1.38.6; 1.39.0 before 1.39.3
CVE-2019-9901
10.0
5%
Apr 25
Envoy 1.9.0 and before does not normalize HTTP URL paths
Affected: through 1.9.0
CVE-2023-35941
9.8
1%
Jul 25
Envoy vulnerable to OAuth2 credentials exploit with permanent validity
Affected: >= 1.26.0, < 1.26.4; >= 1.25.0, < 1.25.9; >= 1.24.0, < 1.24.10; < 1.23.12
CVE-2023-27488
9.8
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2022-21654
9.8
1%
Feb 22
Envoy is an open source edge and service proxy, designed for cloud-native applications
Affected: 1.7.0 before 1.18.6; 1.19.0 before 1.19.3; 1.20.0 before 1.20.2; 1.21.0 before 1.21.1
CVE-2019-18802
9.8
2%
Dec 13
An issue was discovered in Envoy 1.12.0
Affected: through 1.12.1
CVE-2019-18801
9.8
3%
Dec 13
An issue was discovered in Envoy 1.12.0
Affected: through 1.12.1
CVE-2024-39305
9.1
1%
Jul 1
Envoy Proxy use after free when route hash policy is configured with cookie attributes
Affected: >= 1.30.0, < 1.30.4; >= 1.29.0, < 1.29.7; >= 1.28.0, < 1.28.5; < 1.27.7
CVE-2023-27493
9.1
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2023-27491
9.1
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2023-27487
9.1
1%
Apr 4
Envoy is an open source edge and service proxy designed for cloud-native applications
Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3
CVE-2022-29226
9.1
1%
Jun 9
Envoy is a cloud-native high-performance proxy
Affected: before 1.22.1
Showing 12