envoyproxy envoy

• CVE-2026-73511 Medium 5.3 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) 0.4%
• CVE-2026-73553 High 7.5 Envoy: RBAC Authorization Bypass via Path Parameters 0.5%
• CVE-2026-73551 Medium 5.3 Envoy: Path normalization does not handle dot and dotdot segments with parameters 0.5%
• CVE-2026-73546 High 7.4 Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) 0.6%
• CVE-2026-73512 High 7.5 Envoy: use-after-free in QUIC on internal redirects 0.9%
• CVE-2026-73550 High 7.5 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy 0.6%
• CVE-2026-73547 High 7.5 Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check 0.6%
• CVE-2026-48521 Medium 5.9 Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null 0.7%
• CVE-2026-73549 Medium 5.3 Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters 0.6%
• CVE-2026-73513 High 7.5 Envoy: oghttp2 upstream trailers incorrect handling 0.5%
• CVE-2026-73552 High 7.5 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values 0.5%
• CVE-2026-73548 High 7.5 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool 0.5%
• CVE-2026-50572 Medium 5.9 Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault 0.7%
• CVE-2026-48090 Medium 5.9 Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) 0.6%
• CVE-2026-47220 High 7.5 Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format 0.7%
• CVE-2026-47205 Medium 5.9 Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides 0.4%
• CVE-2026-47692 Medium 4.8 Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream 0.2%
• CVE-2026-47207 Medium 6.5 Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message 0.4%
• CVE-2026-48706 Medium 5.9 Envoy Heap Buffer Overflow in TcpStatsdSink 0.6%
• CVE-2026-47204 Medium 6.5 Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes 0.4%
• CVE-2026-47221 Medium 5.9 Envoy: Null pointer deref in internal redirects 0.4%
• CVE-2026-48743 High 7.5 Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length 0.3%
• CVE-2026-48497 Medium 5.9 Envoy: Abnormal process termination in DNS UDP filter 0.4%
• CVE-2026-48044 High 7.5 Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion 0.5%
• CVE-2026-48042 High 7.5 Envoy: Stack overflow in destructor of highly nested JSON 0.6%
• CVE-2026-47778 Medium 4.4 Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) 0.2%
• CVE-2026-47775 Medium 6.8 Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption 0.2%
• CVE-2026-47774 High 7.5 Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification 1.0%
• CVE-2026-26330 Medium 5.3 Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly 0.4%
• CVE-2026-26311 Medium 5.9 Envoy HTTP: filter chain execution on reset streams causing UAF crash 0.4%
• CVE-2026-26310 Medium 5.9 Crash for scoped ip address in Envoy during DNS 0.4%
• CVE-2026-26309 Medium 5.3 Envoy has an off-by-one write in JsonEscaper::escapeString() 0.4%
• CVE-2026-26308 High 7.5 Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation 0.3%
• CVE-2025-66220 Medium 5.0 Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte 0.2%
• CVE-2025-64763 Low 3.7 Envoy forwards early CONNECT data in TCP proxy mode 0.3%
• CVE-2025-64527 Medium 6.5 Envoy crashes when JWT authentication is configured with the remote JWKS fetching 0.6%
• CVE-2025-62504 Medium 6.5 Envoy Lua filter use-after-free when oversized rewritten response body causes crash 0.4%
• CVE-2025-62409 Medium 6.6 Envoy allows large requests and responses to cause TCP connection pool crash 0.5%
• CVE-2025-55162 Medium 6.3 Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag 0.3%
• CVE-2025-54588 High 7.5 Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults 0.5%
• CVE-2025-46821 Medium 5.3 Envoy vulnerable to bypass of RBAC uri_template permission 0.3%
• CVE-2025-30157 Medium 6.5 Envoy crashes when HTTP ext_proc processes local replies 0.4%
• CVE-2024-53271 High 7.1 HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy 0.6%
• CVE-2024-53270 High 7.5 HTTP/1: sending overload crashes when the request is reset beforehand in envoy 0.7%
• CVE-2024-53269 Medium 4.5 Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy 0.7%
• CVE-2024-45806 Medium 6.5 Potential manipulate `x-envoy` headers from external sources in envoy 0.4%
• CVE-2024-45807 High 7.5 oghttp2 crash on OnBeginHeadersForStream in envoy 0.5%
• CVE-2024-45808 Medium 6.5 Malicious log injection via access logs in envoy 0.4%
• CVE-2024-45809 Medium 5.3 Jwt filter crash in the clear route cache with remote JWKs in envoy 0.4%
• CVE-2024-45810 Medium 6.5 Envoy crashes for LocalReply in http async client 0.6%