Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M
CVE-2025-66220Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
Medium 5.0
In plain English
A medium-severity security flaw in envoy from envoyproxy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.2%top 92.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/envoyproxy/envoy | 1.36.3 | GHSA-rwjg-c3h2-f57p |
| Go | github.com/envoyproxy/envoy | 1.35.7 | GHSA-rwjg-c3h2-f57p |
| Go | github.com/envoyproxy/envoy | 1.34.11 | GHSA-rwjg-c3h2-f57p |
| Go | github.com/envoyproxy/envoy | 1.33.13 | GHSA-rwjg-c3h2-f57p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| envoyproxy | envoy | >= 1.36.0, <= 1.36.2>= 1.35.0, <= 1.35.6>= 1.34.0, <= 1.34.10<= 1.33.12 |
Weakness: CWE-170 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p x_refsource_CONFIRM