envoyproxy

Products

Exploited and recent CVEs

• CVE-2026-73511 Medium 5.3 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) 0.4%
• CVE-2026-73553 High 7.5 Envoy: RBAC Authorization Bypass via Path Parameters 0.5%
• CVE-2026-73551 Medium 5.3 Envoy: Path normalization does not handle dot and dotdot segments with parameters 0.5%
• CVE-2026-73546 High 7.4 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) 0.6%
• CVE-2026-73512 High 7.5 Envoy: use-after-free in QUIC on internal redirects 0.9%
• CVE-2026-73550 High 7.5 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy 0.6%
• CVE-2026-73547 High 7.5 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check 0.6%
• CVE-2026-48521 Medium 5.9 Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null 0.7%
• CVE-2026-73549 Medium 5.3 Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters 0.6%
• CVE-2026-73513 High 7.5 Envoy: oghttp2 upstream trailers incorrect handling 0.5%
• CVE-2026-73552 High 7.5 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values 0.5%
• CVE-2026-73548 High 7.5 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool 0.5%
• CVE-2026-50572 Medium 5.9 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault 0.7%
• CVE-2026-53714 High 7.4 Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode 0.3%
• CVE-2026-53716 Medium 6.5 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit 0.7%
• CVE-2026-53715 Medium 5.3 Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock 0.5%
• CVE-2026-53719 Medium 6.5 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization 0.7%
• CVE-2026-53718 Medium 6.4 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass 0.4%
• CVE-2026-53713 Critical 9.1 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure 0.4%
• CVE-2026-53717 Medium 6.5 Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header 0.7%
• CVE-2026-48090 Medium 5.9 Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) 0.6%
• CVE-2026-47220 High 7.5 Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format 0.7%
• CVE-2026-47205 Medium 5.9 Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides 0.4%
• CVE-2026-47692 Medium 4.8 Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream 0.2%
• CVE-2026-47207 Medium 6.5 Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message 0.4%
• CVE-2026-48706 Medium 5.9 Envoy Heap Buffer Overflow in TcpStatsdSink 0.6%
• CVE-2026-47204 Medium 6.5 Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes 0.4%
• CVE-2026-47221 Medium 5.9 Envoy: Null pointer deref in internal redirects 0.4%
• CVE-2026-48743 High 7.5 Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length 0.3%
• CVE-2026-48497 Medium 5.9 Envoy: Abnormal process termination in DNS UDP filter 0.4%