Envoyproxy vulnerabilities
108 CVEs and advisories name Envoyproxy as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-73511Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
- CVE-2026-73553Envoy: RBAC Authorization Bypass via Path Parameters
- CVE-2026-73551Envoy: Path normalization does not handle dot and dotdot segments with parameters
- CVE-2026-73546Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
- CVE-2026-73512Envoy: use-after-free in QUIC on internal redirects
- CVE-2026-73550Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
- CVE-2026-73547Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
- CVE-2026-48521Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
- CVE-2026-73549Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
- CVE-2026-73513Envoy: oghttp2 upstream trailers incorrect handling
- CVE-2026-73552Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
- CVE-2026-73548Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
- CVE-2026-50572Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
- CVE-2026-53714Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
- CVE-2026-53716Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
- CVE-2026-53715Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
- CVE-2026-53719Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
- CVE-2026-53718Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
- CVE-2026-53713Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
- CVE-2026-53717Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
- CVE-2026-48090Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)
- CVE-2026-47220Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format
- CVE-2026-47205Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides
- CVE-2026-47692Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
- CVE-2026-47207Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message
- CVE-2026-48706Envoy Heap Buffer Overflow in TcpStatsdSink
- CVE-2026-47204Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
- CVE-2026-47221Envoy: Null pointer deref in internal redirects
- CVE-2026-48743Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length
- CVE-2026-48497Envoy: Abnormal process termination in DNS UDP filter