Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/envoyproxy/gateway

10 known vulnerabilities (1 critical, 3 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 1 critical, 3 high, 6 medium
Registry
pkg.go.dev

Advisories 10

  • Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode

    Affected: from 1.8.0-rc.0, fixed in 1.8.1; fixed in 1.7.4; fixed in 1.7.4; from 1.8.0-rc.0, fixed in 1.8.1.

  • CVE-2026-53716Medium 6.5

    Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

    Affected: fixed in 1.7.4; from 1.8.0-rc.0, fixed in 1.8.1; from 1.8.0-rc.0, fixed in 1.8.1; fixed in 1.7.4.

  • CVE-2026-53715Medium 5.3

    Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

    Affected: fixed in 1.7.4; from 1.8.0-rc.0, fixed in 1.8.1; from 1.8.0-rc.0, fixed in 1.8.1; fixed in 1.7.4.

  • CVE-2026-53719Medium 6.5

    Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

    Affected: fixed in 1.7.4; from 1.8.0-rc.0, fixed in 1.8.1; from 1.8.0-rc.0, fixed in 1.8.1; fixed in 1.7.4.

  • CVE-2026-53718Medium 6.4

    Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

    Affected: from 1.8.0-rc.0, fixed in 1.8.1; fixed in 1.7.4; fixed in 1.7.4; from 1.8.0-rc.0, fixed in 1.8.1.

  • CVE-2026-53713Critical 9.1

    Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

    Affected: from 1.8.0-rc.0, fixed in 1.8.1; fixed in 1.7.4; fixed in 1.7.4; from 1.8.0-rc.0, fixed in 1.8.1.

  • CVE-2026-53717Medium 6.5

    Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

    Affected: from 1.8.0-rc.0, fixed in 1.8.1; fixed in 1.7.4; fixed in 1.7.4; from 1.8.0-rc.0, fixed in 1.8.1.

  • Envoy Extension Policy lua scripts injection causes arbitrary command execution

    Affected: fixed in 1.5.7; from 1.6.0-rc.0, fixed in 1.6.2; from 1.6.0-rc.0, fixed in 1.6.2; fixed in 1.5.7.

  • CVE-2025-25294Medium 5.3

    Envoy Gateway Log Injection Vulnerability

    Affected: fixed in 1.2.7; from 1.3.0-rc.1, fixed in 1.3.1; fixed in 1.2.7; from 1.3.0-rc.1, fixed in 1.3.1.

  • Envoy Admin Interface Exposed through prometheus metrics endpoint

    Affected: fixed in 1.2.6.