envoyproxy envoy vulnerabilities

Latest envoyproxy envoy CVEs

Newest publication first · page 1 of 6

1. CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder

   Published 2026-10-22

   Critical·CVSS 9.2 EPSS 82.6% CISA KEV added 2026-10-27 Exploited in the wild PoC

   A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,...

2. CVE-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

   Published 2026-09-21

   Medium·CVSS 5.3 EPSS 0.38%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment...

3. CVE-2026-73553 Envoy: RBAC Authorization Bypass via Path Parameters

   Published 2026-09-21

   High·CVSS 7.5 EPSS 0.51%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher e...

4. CVE-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters

   Published 2026-09-21

   Medium·CVSS 5.3 EPSS 0.53%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/...

5. CVE-2026-73546 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

   Published 2026-09-21

   High·CVSS 7.4 EPSS 0.62%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML enco...

6. CVE-2026-73512 Envoy: use-after-free in QUIC on internal redirects

   Published 2026-09-21

   High·CVSS 7.5 EPSS 0.87%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect,...

7. CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

   Published 2026-09-21

   High·CVSS 7.5 EPSS 0.55%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeade...

8. CVE-2026-73547 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

   Published 2026-09-21

   High·CVSS 7.5 EPSS 0.55%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove f...

9. CVE-2026-48521 Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

   Published 2026-09-21

   Medium·CVSS 5.9 EPSS 0.74%

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first c...

10. CVE-2026-73549 Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

    Published 2026-09-21

    Medium·CVSS 5.3 EPSS 0.62%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instanc...

11. CVE-2026-73513 Envoy: oghttp2 upstream trailers incorrect handling

    Published 2026-09-21

    High·CVSS 7.5 EPSS 0.49%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes th...

12. CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

    Published 2026-09-21

    High·CVSS 7.5 EPSS 0.49%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can p...

13. CVE-2026-73548 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

    Published 2026-09-21

    High·CVSS 7.5 EPSS 0.46%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place...

14. CVE-2026-50572 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

    Published 2026-09-21

    Medium·CVSS 5.9 EPSS 0.68%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later...

15. CVE-2026-48090 Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

    Published 2026-06-26

    Medium·CVSS 5.9 EPSS 0.58%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn do...

16. CVE-2026-47220 Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

    Published 2026-06-26

    High·CVSS 7.5 EPSS 0.66%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy...

17. CVE-2026-47205 Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

    Published 2026-06-26

    Medium·CVSS 5.9 EPSS 0.39%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability leading to a sudden segmentation fault exists in Envoy's ext_authz HTTP filter when processing per-route autho...

18. CVE-2026-47692 Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

    Published 2026-06-26

    Medium·CVSS 4.3 EPSS 0.22%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the l...

19. CVE-2026-47207 Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

    Published 2026-06-26

    Medium·CVSS 6.5 EPSS 0.44%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This c...

20. CVE-2026-48706 Envoy Heap Buffer Overflow in TcpStatsdSink

    Published 2026-06-26

    High·CVSS 7.5 EPSS 0.61%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionall...

21. CVE-2026-47204 Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes

    Published 2026-06-26

    High·CVSS 7.5 EPSS 0.45%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the envoy.filters.http.grpc_stats filter crashes (null pointer dereference / segfault) when a Connect protocol request (Content-Type: appl...

22. CVE-2026-47221 Envoy: Null pointer deref in internal redirects

    Published 2026-06-26

    High·CVSS 7.5 EPSS 0.45%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less no...

23. CVE-2026-48743 Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

    Published 2026-06-26

    High·CVSS 7.5 EPSS 0.30%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a...

24. CVE-2026-48497 Envoy: Abnormal process termination in DNS UDP filter

    Published 2026-06-26

    High·CVSS 7.5 EPSS 0.40%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote resolution for a name o...

25. CVE-2026-48044 Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion

    Published 2026-06-26

    High·CVSS 7.5 EPSS 0.49%

    Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.