EN
Product
envoy
On CISA KEVExploited in the wild
127
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 12High 83Medium 31Low 1
Watch
Add envoy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47775 | 6.8 | Jun 26 | Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11 |
| CVE-2026-47207 | 6.5 | Jun 26 | Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.34.0, < 1.35.13 |
| CVE-2025-64527 | 6.5 | Dec 3 | Envoy crashes when JWT authentication is configured with the remote JWKS fetching Affected: >= 1.36.0, <= 1.36.2; >= 1.35.0, <= 1.35.6; >= 1.34.0, <= 1.34.10; <= 1.33.12 |
| CVE-2024-45806 | 6.5 | Sep 19 | Potential manipulate `x-envoy` headers from external sources in envoy Affected: >= 1.31.0, < 1.31.2; >= 1.30.0, < 1.30.6; >= 1.29.0, < 1.29.9; < 1.28.7 |
| CVE-2024-45808 | 6.5 | Sep 19 | Malicious log injection via access logs in envoy Affected: >= 1.31.0, < 1.31.2; >= 1.30.0, < 1.30.6; >= 1.29.0, < 1.29.9; < 1.28.7 |
| CVE-2024-34364 | 6.5 | Jun 4 | Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response Affected: >= 1.30.0, <= 11.30.1; >= 1.29.0, <= 1.29.4; >= 1.28.0, <= 1.28.3; <= 1.27.5 |
| CVE-2023-35942 | 6.5 | Jul 25 | Envoy's gRPC access log crash caused by the listener draining Affected: >= 1.26.0, < 1.26.4; >= 1.25.0, < 1.25.9; >= 1.24.0, < 1.24.10; < 1.23.12 |
| CVE-2023-27492 | 6.5 | Apr 4 | Envoy is an open source edge and service proxy designed for cloud-native applications Affected: before 1.22.9; 1.23.0 before 1.23.6; 1.24.0 before 1.24.4; 1.25.0 before 1.25.3 |
| CVE-2022-23606 | 6.5 | Feb 22 | Envoy is an open source edge and service proxy, designed for cloud-native applications Affected: 1.20.0 before 1.20.2; 1.21.0 |
| CVE-2022-21657 | 6.5 | Feb 22 | Envoy is an open source edge and service proxy, designed for cloud-native applications Affected: before 1.18.6; 1.19.0 before 1.19.3; 1.20.0 before 1.20.2 |
| CVE-2026-48521 | 5.9 | Sep 21 | Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-50572 | 5.9 | Sep 21 | Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-48090 | 5.9 | Jun 26 | Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5 |
| CVE-2026-47205 | 5.9 | Jun 26 | Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9 |
| CVE-2026-26311 | 5.9 | Mar 10 | Envoy HTTP: filter chain execution on reset streams causing UAF crash Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2024-34362 | 5.9 | Jun 4 | Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream Affected: >= 1.30.0, <= 11.30.1; >= 1.29.0, <= 1.29.4; >= 1.28.0, <= 1.28.3; <= 1.27.5 |
| CVE-2022-29224 | 5.9 | Jun 9 | Envoy is a cloud-native high-performance proxy Affected: before 1.22.1 |
| CVE-2022-21656 | 5.9 | Feb 22 | Envoy is an open source edge and service proxy, designed for cloud-native applications Affected: before 1.20.2 |
| CVE-2020-15104 | 5.4 | Jul 14 | In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to… Affected: before 1.12.6; 1.13.0 before 1.13.4; 1.14.0 before 1.14.4 |
| CVE-2026-73511 | 5.3 | Sep 21 | Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73551 | 5.3 | Sep 21 | Envoy: Path normalization does not handle dot and dotdot segments with parameters Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-73549 | 5.3 | Sep 21 | Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters Affected: < 1.36.10; >= 1.37.0, < 1.37.6; >= 1.38.0, < 1.38.4; >= 1.39.0, < 1.39.1 |
| CVE-2026-26309 | 5.3 | Mar 10 | Envoy has an off-by-one write in JsonEscaper::escapeString() Affected: >= 1.37.0, < 1.37.1; >= 1.36.0, < 1.36.5; >= 1.35.0, < 1.35.9; < 1.34.13 |
| CVE-2025-64763 | 5.3 | Dec 3 | Envoy forwards early CONNECT data in TCP proxy mode Affected: >= 1.36.0, <= 1.36.2; >= 1.35.0, <= 1.35.6; >= 1.34.0, <= 1.34.10; <= 1.33.12 |
| CVE-2025-46821 | 5.3 | May 7 | Envoy vulnerable to bypass of RBAC uri_template permission Affected: < 1.31.8; >= 1.32.0, < 1.32.6; >= 1.33.0, < 1.33.3; >= 1.34.0, < 1.34.1 |
| CVE-2024-23323 | 5.3 | Feb 9 | Excessive CPU usage when URI template matcher is configured using regex in Envoy Affected: >= 1.29.0, < 1.29.1; >= 1.28.0, < 1.28.1; >= 1.27.0, < 1.27.3; < 1.26.7 |
| CVE-2023-35944 | 5.3 | Jul 25 | Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes Affected: >= 1.26.0, < 1.26.4; >= 1.25.0, < 1.25.9; >= 1.24.0, < 1.24.10; < 1.23.12 |
| CVE-2020-8660 | 5.3 | Mar 4 | CNCF Envoy through 1.13.0 TLS inspector bypass Affected: before 1.12.3; 1.13.0 before 1.13.1 |
| CVE-2020-8664 | 5.3 | Mar 4 | CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context Affected: through 1.13.0 |
| CVE-2026-47778 | 4.4 | Jun 26 | Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) Affected: >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.3; >= 1.36.0, < 1.36.7; < 1.35.11 |
| CVE-2026-47692 | 4.3 | Jun 26 | Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream Affected: >= 1.38.0, < 1.38.3; >= 1.37.0, < 1.37.5; >= 1.36.0, < 1.36.9; >= 1.34.0, < 1.35.13 |
Showing 31