envoyproxy envoy

• CVE-2024-39305 Medium 6.5 Envoy Proxy use after free when route hash policy is configured with cookie attributes 0.6%
• CVE-2024-32974 Medium 5.9 Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete() 0.7%
• CVE-2024-32975 Medium 5.9 Envoy crashes in QuicheDataReader::PeekVarInt62Length() 0.7%
• CVE-2024-32976 High 7.5 Envoy can enter an endless loop while decompressing Brotli data with extra input 0.7%
• CVE-2024-34362 Medium 5.9 Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream 0.6%
• CVE-2024-34363 High 7.5 Envoy can crash due to uncaught nlohmann JSON exception 0.7%
• CVE-2024-34364 Medium 5.7 Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response 0.5%
• CVE-2024-23326 Medium 5.9 Envoy incorrectly accepts HTTP 200 response for entering upgrade mode 0.4%
• CVE-2024-32475 High 7.5 Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes 0.7%
• CVE-2024-30255 Medium 5.3 HTTP/2: CPU exhaustion due to CONTINUATION frame flood 85.0%
• CVE-2024-27919 High 7.5 HTTP/2: memory exhaustion due to CONTINUATION frame flood 83.9%
• CVE-2024-23322 High 7.5 Envoy crashes when idle and request per try timeout occur within the backoff interval 0.7%
• CVE-2024-23323 Medium 4.3 Excessive CPU usage when URI template matcher is configured using regex in Envoy 0.5%
• CVE-2024-23324 High 8.6 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata 0.6%
• CVE-2024-23325 High 7.5 Envoy crashes when using an address type that isn’t supported by the OS 0.8%
• CVE-2024-23327 High 7.5 Crash in proxy protocol when command type of LOCAL in Envoy 0.7%
• CVE-2023-35944 High 8.2 Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes 0.7%
• CVE-2023-35943 Medium 6.3 Envoy vulnerable to CORS filter segfault when origin header is removed 0.7%
• CVE-2023-35942 Medium 6.5 Envoy's gRPC access log crash caused by the listener draining 0.9%
• CVE-2023-35941 High 8.6 Envoy vulnerable to OAuth2 credentials exploit with permanent validity 0.8%
• CVE-2023-35945 High 7.5 Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec 1.7%
• CVE-2023-27496 Medium 6.5 Envoy may crash when a redirect url without a state param is received in the oauth filter 0.8%
• CVE-2023-27493 High 8.1 Envoy doesn't escape HTTP header values 0.5%
• CVE-2023-27492 Medium 4.8 Envoy may crash when a large request body is processed in Lua filter 0.7%
• CVE-2023-27491 Medium 5.4 Envoy forwards invalid Http2/Http3 downstream headers 0.9%
• CVE-2023-27488 Medium 5.4 Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received. 0.7%
• CVE-2023-27487 High 8.2 Envoy client may fake the header `x-envoy-original-path` 0.6%
• CVE-2022-29227 High 7.5 Use after free in Envoy 1.2%
• CVE-2022-29226 Critical 10.0 Trivial authentication bypass in Envoy 1.4%
• CVE-2022-29228 High 7.5 Reachable assertion in Envoy 1.3%
• CVE-2022-29225 High 7.5 Zip bomb vulnerability in Envoy 1.6%
• CVE-2022-29224 Medium 5.9 Segmentation fault leading to crash in Envoy 1.0%
• CVE-2021-43826 High 7.5 Crash when tunneling TCP over HTTP in Envoy 1.1%
• CVE-2021-43825 Medium 6.1 Use-after-free in Envoy 0.9%
• CVE-2022-21655 High 7.5 Incorrect handling of internal redirects results in crash in Envoy 1.1%
• CVE-2022-21654 High 7.4 Incorrect configuration handling allows TLS session re-use without re-validation in Envoy 1.1%
• CVE-2022-21657 Medium 6.8 X.509 Extended Key Usage and Trust Purposes bypass in Envoy 0.5%
• CVE-2022-21656 High 7.4 X.509 subjectAltName matching bypass in Envoy 0.7%
• CVE-2022-23606 Medium 4.4 Crash when a cluster is deleted in Envoy 1.0%
• CVE-2021-43824 High 7.5 Null pointer dereference in envoy 1.1%
• CVE-2021-32780 High 8.6 Incorrect handling of H/2 GOAWAY followed by SETTINGS frames 1.2%
• CVE-2021-32781 High 8.6 Continued processing of requests after locally generated response 1.3%
• CVE-2021-32779 High 8.6 Incorrectly handling of URI '#fragment' element as part of the path element 1.0%
• CVE-2021-32778 Medium 5.8 Excessive CPU utilization when closing HTTP/2 streams 1.2%
• CVE-2021-32777 High 8.6 Incorrect concatenation of multiple value request headers in ext-authz extension 3.3%
• CVE-2021-29492 High 8.1 Bypass of path matching rules using escaped slash characters 63.1%
• CVE-2021-21378 High 8.2 JWT authentication bypass with unknown issuer token 1.7%
• CVE-2020-15104 Medium 4.6 TLS Validation Vulnerability in Envoy 0.3%