Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/envoyproxy/envoy

11 known vulnerabilities (2 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 2 high, 8 medium, 1 low
Registry
pkg.go.dev

Advisories 11

  • CVE-2026-26330Medium 5.3

    Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly

    Affected: versions 1.37.0; from 1.36.0, through 1.36.4.

  • CVE-2026-26311Medium 5.9

    Envoy HTTP: filter chain execution on reset streams causing UAF crash

    Affected: versions 1.37.0; from 1.36.0, through 1.36.4; from 1.35.0, through 1.35.8; through 1.34.12.

  • CVE-2026-26310Medium 5.9

    Crash for scoped ip address in Envoy during DNS

    Affected: versions 1.37.0; from 1.36.0, through 1.36.4; from 1.35.0, through 1.35.8; through 1.34.12.

  • CVE-2026-26309Medium 5.3

    Envoy has an off-by-one write in JsonEscaper::escapeString()

    Affected: versions 1.37.0; from 1.36.0, through 1.36.4; from 1.35.0, through 1.35.8; through 1.34.12.

  • Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation

    Affected: from 1.37.0, fixed in 1.37.1; from 1.36.0, fixed in 1.36.5; from 1.35.0, fixed in 1.35.9; fixed in 1.34.13.

  • CVE-2025-66220Medium 5.0

    Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

    Affected: from 1.36.0, fixed in 1.36.3; from 1.35.0, fixed in 1.35.7; from 1.34.0, fixed in 1.34.11; fixed in 1.33.13.

  • Envoy forwards early CONNECT data in TCP proxy mode

    Affected: from 1.36.0, fixed in 1.36.3; from 1.35.0, fixed in 1.35.7; from 1.34.0, fixed in 1.34.11; fixed in 1.33.13.

  • CVE-2025-64527Medium 6.5

    Envoy crashes when JWT authentication is configured with the remote JWKS fetching

    Affected: from 1.36.0, fixed in 1.36.3; from 1.35.0, fixed in 1.35.7; from 1.34.0, fixed in 1.34.11; fixed in 1.33.13.

  • Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

    Affected: from 1.35.0, fixed in 1.35.1; from 1.34.0, fixed in 1.34.5.

  • CVE-2025-30157Medium 6.5

    Envoy crashes when HTTP ext_proc processes local replies

    Affected: fixed in 1.30.10; from 1.31.0, fixed in 1.31.6; from 1.32.0, fixed in 1.32.4; from 1.33.0, fixed in 1.33.1.

  • CVE-2019-9901Medium 6.5

    Envoy 1.9.0 and before does not normalize HTTP URL paths.

    Affected: fixed in 1.9.1.