# cve.now: Envoyproxy

The newest entries naming Envoyproxy as an affected vendor (up to 200), of 108 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-73511](https://cve.now/CVE-2026-73511.md): Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) (CVSS 5.3)
- [CVE-2026-73553](https://cve.now/CVE-2026-73553.md): Envoy: RBAC Authorization Bypass via Path Parameters (CVSS 7.5)
- [CVE-2026-73551](https://cve.now/CVE-2026-73551.md): Envoy: Path normalization does not handle dot and dotdot segments with parameters (CVSS 5.3)
- [CVE-2026-73546](https://cve.now/CVE-2026-73546.md): Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) (CVSS 7.4)
- [CVE-2026-73512](https://cve.now/CVE-2026-73512.md): Envoy: use-after-free in QUIC on internal redirects (CVSS 7.5)
- [CVE-2026-73550](https://cve.now/CVE-2026-73550.md): Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy (CVSS 7.5)
- [CVE-2026-73547](https://cve.now/CVE-2026-73547.md): Envoy ext\_authz: request \`:path\` pseudoheader dereferenced w/o null check (CVSS 7.5)
- [CVE-2026-48521](https://cve.now/CVE-2026-48521.md): Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport\_socket\_options is null (CVSS 5.9)
- [CVE-2026-73549](https://cve.now/CVE-2026-73549.md): Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL\_DST clusters (CVSS 5.3)
- [CVE-2026-73513](https://cve.now/CVE-2026-73513.md): Envoy: oghttp2 upstream trailers incorrect handling (CVSS 7.5)
- [CVE-2026-73552](https://cve.now/CVE-2026-73552.md): Envoy: HTTP RBAC safe\_regex can fail open on RFC-valid obs-text header values (CVSS 7.5)
- [CVE-2026-73548](https://cve.now/CVE-2026-73548.md): Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool (CVSS 7.5)
- [CVE-2026-50572](https://cve.now/CVE-2026-50572.md): Envoy: ext\_authz - RawHttpClientImpl onSuccess 0x0 segfault (CVSS 5.9)
- [CVE-2026-53714](https://cve.now/CVE-2026-53714.md): Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode (CVSS 7.4)
- [CVE-2026-53716](https://cve.now/CVE-2026-53716.md): Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit (CVSS 6.5)
- [CVE-2026-53715](https://cve.now/CVE-2026-53715.md): Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock (CVSS 5.3)
- [CVE-2026-53719](https://cve.now/CVE-2026-53719.md): Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization (CVSS 6.5)
- [CVE-2026-53718](https://cve.now/CVE-2026-53718.md): Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass (CVSS 6.4)
- [CVE-2026-53713](https://cve.now/CVE-2026-53713.md): Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure (CVSS 9.1)
- [CVE-2026-53717](https://cve.now/CVE-2026-53717.md): Envoy Gateway: OCI layer extraction allocates make(\[\]byte, h.Size) from untrusted tar header (CVSS 6.5)
- [CVE-2026-48090](https://cve.now/CVE-2026-48090.md): Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) (CVSS 5.9)
- [CVE-2026-47220](https://cve.now/CVE-2026-47220.md): Envoy: Segmentation fault when using %REQUESTED\_SERVER\_NAME% in log format (CVSS 7.5)
- [CVE-2026-47205](https://cve.now/CVE-2026-47205.md): Envoy: ext\_authz Use-After-Free during Stream Teardown with Per-Route Overrides (CVSS 5.9)
- [CVE-2026-47692](https://cve.now/CVE-2026-47692.md): Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream (CVSS 4.8)
- [CVE-2026-47207](https://cve.now/CVE-2026-47207.md): Envoy crashes if multiple unexpected ext\_proc responses are packed into one gRPC message (CVSS 6.5)
- [CVE-2026-48706](https://cve.now/CVE-2026-48706.md): Envoy Heap Buffer Overflow in TcpStatsdSink (CVSS 5.9)
- [CVE-2026-47204](https://cve.now/CVE-2026-47204.md): Envoy: grpc\_stats filter segfault on Connect protocol requests to direct\_response routes (CVSS 6.5)
- [CVE-2026-47221](https://cve.now/CVE-2026-47221.md): Envoy: Null pointer deref in internal redirects (CVSS 5.9)
- [CVE-2026-48743](https://cve.now/CVE-2026-48743.md): Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length (CVSS 7.5)
- [CVE-2026-48497](https://cve.now/CVE-2026-48497.md): Envoy: Abnormal process termination in DNS UDP filter (CVSS 5.9)
- [CVE-2026-48044](https://cve.now/CVE-2026-48044.md): Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion (CVSS 7.5)
- [CVE-2026-48042](https://cve.now/CVE-2026-48042.md): Envoy: Stack overflow in destructor of highly nested JSON (CVSS 7.5)
- [CVE-2026-47778](https://cve.now/CVE-2026-47778.md): Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) (CVSS 4.4)
- [CVE-2026-47775](https://cve.now/CVE-2026-47775.md): Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption (CVSS 6.8)
- [CVE-2026-47774](https://cve.now/CVE-2026-47774.md): Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification (CVSS 7.5)
- [CVE-2026-26330](https://cve.now/CVE-2026-26330.md): Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly (CVSS 5.3)
- [CVE-2026-26311](https://cve.now/CVE-2026-26311.md): Envoy HTTP: filter chain execution on reset streams causing UAF crash (CVSS 5.9)
- [CVE-2026-26310](https://cve.now/CVE-2026-26310.md): Crash for scoped ip address in Envoy during DNS (CVSS 5.9)
- [CVE-2026-26309](https://cve.now/CVE-2026-26309.md): Envoy has an off-by-one write in JsonEscaper::escapeString() (CVSS 5.3)
- [CVE-2026-26308](https://cve.now/CVE-2026-26308.md): Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation (CVSS 7.5)
- [CVE-2026-22771](https://cve.now/CVE-2026-22771.md): Envoy Extension Policy lua scripts injection causes arbitrary command execution (CVSS 8.8)
- [CVE-2025-66220](https://cve.now/CVE-2025-66220.md): Envoy’s TLS certificate matcher for \`match\_typed\_subject\_alt\_names\` may incorrectly treat certificates containing an embedded null byte (CVSS 5.0)
- [CVE-2025-64763](https://cve.now/CVE-2025-64763.md): Envoy forwards early CONNECT data in TCP proxy mode (CVSS 3.7)
- [CVE-2025-64527](https://cve.now/CVE-2025-64527.md): Envoy crashes when JWT authentication is configured with the remote JWKS fetching (CVSS 6.5)
- [CVE-2025-62504](https://cve.now/CVE-2025-62504.md): Envoy Lua filter use-after-free when oversized rewritten response body causes crash (CVSS 6.5)
- [CVE-2025-62409](https://cve.now/CVE-2025-62409.md): Envoy allows large requests and responses to cause TCP connection pool crash (CVSS 6.6)
- [CVE-2025-55162](https://cve.now/CVE-2025-55162.md): Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag (CVSS 6.3)
- [CVE-2025-54588](https://cve.now/CVE-2025-54588.md): Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults (CVSS 7.5)
- [CVE-2025-46821](https://cve.now/CVE-2025-46821.md): Envoy vulnerable to bypass of RBAC uri\_template permission (CVSS 5.3)
- [CVE-2025-30157](https://cve.now/CVE-2025-30157.md): Envoy crashes when HTTP ext\_proc processes local replies (CVSS 6.5)
- [CVE-2025-25294](https://cve.now/CVE-2025-25294.md): Envoy Gateway Log Injection Vulnerability (CVSS 5.3)
- [CVE-2025-24030](https://cve.now/CVE-2025-24030.md): Envoy Admin Interface Exposed through prometheus metrics endpoint (CVSS 7.1)
- [CVE-2024-53271](https://cve.now/CVE-2024-53271.md): HTTP/1.1 multiple issues with envoy.reloadable\_features.http1\_balsa\_delay\_reset in envoy (CVSS 7.1)
- [CVE-2024-53270](https://cve.now/CVE-2024-53270.md): HTTP/1: sending overload crashes when the request is reset beforehand in envoy (CVSS 7.5)
- [CVE-2024-53269](https://cve.now/CVE-2024-53269.md): Happy Eyeballs: Validate that additional\_address are IP addresses instead of crashing when sorting in envoy (CVSS 4.5)
- [CVE-2024-45806](https://cve.now/CVE-2024-45806.md): Potential manipulate \`x-envoy\` headers from external sources in envoy (CVSS 6.5)
- [CVE-2024-45807](https://cve.now/CVE-2024-45807.md): oghttp2 crash on OnBeginHeadersForStream in envoy (CVSS 7.5)
- [CVE-2024-45808](https://cve.now/CVE-2024-45808.md): Malicious log injection via access logs in envoy (CVSS 6.5)
- [CVE-2024-45809](https://cve.now/CVE-2024-45809.md): Jwt filter crash in the clear route cache with remote JWKs in envoy (CVSS 5.3)
- [CVE-2024-45810](https://cve.now/CVE-2024-45810.md): Envoy crashes for LocalReply in http async client (CVSS 6.5)
- [CVE-2024-39305](https://cve.now/CVE-2024-39305.md): Envoy Proxy use after free when route hash policy is configured with cookie attributes (CVSS 6.5)
- [CVE-2024-32974](https://cve.now/CVE-2024-32974.md): Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete() (CVSS 5.9)
- [CVE-2024-32975](https://cve.now/CVE-2024-32975.md): Envoy crashes in QuicheDataReader::PeekVarInt62Length() (CVSS 5.9)
- [CVE-2024-32976](https://cve.now/CVE-2024-32976.md): Envoy can enter an endless loop while decompressing Brotli data with extra input (CVSS 7.5)
- [CVE-2024-34362](https://cve.now/CVE-2024-34362.md): Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream (CVSS 5.9)
- [CVE-2024-34363](https://cve.now/CVE-2024-34363.md): Envoy can crash due to uncaught nlohmann JSON exception (CVSS 7.5)
- [CVE-2024-34364](https://cve.now/CVE-2024-34364.md): Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response (CVSS 5.7)
- [CVE-2024-23326](https://cve.now/CVE-2024-23326.md): Envoy incorrectly accepts HTTP 200 response for entering upgrade mode (CVSS 5.9)
- [CVE-2024-32475](https://cve.now/CVE-2024-32475.md): Envoy RELEASE\_ASSERT using auto\_sni with :authority header \> 255 bytes (CVSS 7.5)
- [CVE-2024-30255](https://cve.now/CVE-2024-30255.md): HTTP/2: CPU exhaustion due to CONTINUATION frame flood (CVSS 5.3)
- [CVE-2024-27919](https://cve.now/CVE-2024-27919.md): HTTP/2: memory exhaustion due to CONTINUATION frame flood (CVSS 7.5)
- [CVE-2024-23322](https://cve.now/CVE-2024-23322.md): Envoy crashes when idle and request per try timeout occur within the backoff interval (CVSS 7.5)
- [CVE-2024-23323](https://cve.now/CVE-2024-23323.md): Excessive CPU usage when URI template matcher is configured using regex in Envoy (CVSS 4.3)
- [CVE-2024-23324](https://cve.now/CVE-2024-23324.md): Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata (CVSS 8.6)
- [CVE-2024-23325](https://cve.now/CVE-2024-23325.md): Envoy crashes when using an address type that isn’t supported by the OS (CVSS 7.5)
- [CVE-2024-23327](https://cve.now/CVE-2024-23327.md): Crash in proxy protocol when command type of LOCAL in Envoy (CVSS 7.5)
- [CVE-2023-35944](https://cve.now/CVE-2023-35944.md): Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes (CVSS 8.2)
- [CVE-2023-35943](https://cve.now/CVE-2023-35943.md): Envoy vulnerable to CORS filter segfault when origin header is removed (CVSS 6.3)
- [CVE-2023-35942](https://cve.now/CVE-2023-35942.md): Envoy's gRPC access log crash caused by the listener draining (CVSS 6.5)
- [CVE-2023-35941](https://cve.now/CVE-2023-35941.md): Envoy vulnerable to OAuth2 credentials exploit with permanent validity (CVSS 8.6)
- [CVE-2023-35945](https://cve.now/CVE-2023-35945.md): Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec (CVSS 7.5)
- [CVE-2023-27496](https://cve.now/CVE-2023-27496.md): Envoy may crash when a redirect url without a state param is received in the oauth filter (CVSS 6.5)
- [CVE-2023-27493](https://cve.now/CVE-2023-27493.md): Envoy doesn't escape HTTP header values (CVSS 8.1)
- [CVE-2023-27492](https://cve.now/CVE-2023-27492.md): Envoy may crash when a large request body is processed in Lua filter (CVSS 4.8)
- [CVE-2023-27491](https://cve.now/CVE-2023-27491.md): Envoy forwards invalid Http2/Http3 downstream headers (CVSS 5.4)
- [CVE-2023-27488](https://cve.now/CVE-2023-27488.md): Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received. (CVSS 5.4)
- [CVE-2023-27487](https://cve.now/CVE-2023-27487.md): Envoy client may fake the header \`x-envoy-original-path\` (CVSS 8.2)
- [CVE-2022-29227](https://cve.now/CVE-2022-29227.md): Use after free in Envoy (CVSS 7.5)
- [CVE-2022-29226](https://cve.now/CVE-2022-29226.md): Trivial authentication bypass in Envoy (CVSS 10.0)
- [CVE-2022-29228](https://cve.now/CVE-2022-29228.md): Reachable assertion in Envoy (CVSS 7.5)
- [CVE-2022-29225](https://cve.now/CVE-2022-29225.md): Zip bomb vulnerability in Envoy (CVSS 7.5)
- [CVE-2022-29224](https://cve.now/CVE-2022-29224.md): Segmentation fault leading to crash in Envoy (CVSS 5.9)
- [CVE-2021-43826](https://cve.now/CVE-2021-43826.md): Crash when tunneling TCP over HTTP in Envoy (CVSS 7.5)
- [CVE-2021-43825](https://cve.now/CVE-2021-43825.md): Use-after-free in Envoy (CVSS 6.1)
- [CVE-2022-21655](https://cve.now/CVE-2022-21655.md): Incorrect handling of internal redirects results in crash in Envoy (CVSS 7.5)
- [CVE-2022-21654](https://cve.now/CVE-2022-21654.md): Incorrect configuration handling allows TLS session re-use without re-validation in Envoy (CVSS 7.4)
- [CVE-2022-21657](https://cve.now/CVE-2022-21657.md): X.509 Extended Key Usage and Trust Purposes bypass in Envoy (CVSS 6.8)
- [CVE-2022-21656](https://cve.now/CVE-2022-21656.md): X.509 subjectAltName matching bypass in Envoy (CVSS 7.4)
- [CVE-2022-23606](https://cve.now/CVE-2022-23606.md): Crash when a cluster is deleted in Envoy (CVSS 4.4)
- [CVE-2021-43824](https://cve.now/CVE-2021-43824.md): Null pointer dereference in envoy (CVSS 7.5)
- [CVE-2021-32780](https://cve.now/CVE-2021-32780.md): Incorrect handling of H/2 GOAWAY followed by SETTINGS frames (CVSS 8.6)
- [CVE-2021-32781](https://cve.now/CVE-2021-32781.md): Continued processing of requests after locally generated response (CVSS 8.6)
- [CVE-2021-32779](https://cve.now/CVE-2021-32779.md): Incorrectly handling of URI '#fragment' element as part of the path element (CVSS 8.6)
- [CVE-2021-32778](https://cve.now/CVE-2021-32778.md): Excessive CPU utilization when closing HTTP/2 streams (CVSS 5.8)
- [CVE-2021-32777](https://cve.now/CVE-2021-32777.md): Incorrect concatenation of multiple value request headers in ext-authz extension (CVSS 8.6)
- [CVE-2021-29492](https://cve.now/CVE-2021-29492.md): Bypass of path matching rules using escaped slash characters (CVSS 8.1)
- [CVE-2021-21378](https://cve.now/CVE-2021-21378.md): JWT authentication bypass with unknown issuer token (CVSS 8.2)
- [CVE-2020-15104](https://cve.now/CVE-2020-15104.md): TLS Validation Vulnerability in Envoy (CVSS 4.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/envoyproxy
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.