Envoyproxy vulnerabilities
108 CVEs and advisories name Envoyproxy as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-48044Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
- CVE-2026-48042Envoy: Stack overflow in destructor of highly nested JSON
- CVE-2026-47778Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
- CVE-2026-47775Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption
- CVE-2026-47774Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
- CVE-2026-26330Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly
- CVE-2026-26311Envoy HTTP: filter chain execution on reset streams causing UAF crash
- CVE-2026-26310Crash for scoped ip address in Envoy during DNS
- CVE-2026-26309Envoy has an off-by-one write in JsonEscaper::escapeString()
- CVE-2026-26308Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation
- CVE-2026-22771Envoy Extension Policy lua scripts injection causes arbitrary command execution
- CVE-2025-66220Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
- CVE-2025-64763Envoy forwards early CONNECT data in TCP proxy mode
- CVE-2025-64527Envoy crashes when JWT authentication is configured with the remote JWKS fetching
- CVE-2025-62504Envoy Lua filter use-after-free when oversized rewritten response body causes crash
- CVE-2025-62409Envoy allows large requests and responses to cause TCP connection pool crash
- CVE-2025-55162Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag
- CVE-2025-54588Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults
- CVE-2025-46821Envoy vulnerable to bypass of RBAC uri_template permission
- CVE-2025-30157Envoy crashes when HTTP ext_proc processes local replies
- CVE-2025-25294Envoy Gateway Log Injection Vulnerability
- CVE-2025-24030Envoy Admin Interface Exposed through prometheus metrics endpoint
- CVE-2024-53271HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy
- CVE-2024-53270HTTP/1: sending overload crashes when the request is reset beforehand in envoy
- CVE-2024-53269Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy
- CVE-2024-45806Potential manipulate `x-envoy` headers from external sources in envoy
- CVE-2024-45807oghttp2 crash on OnBeginHeadersForStream in envoy
- CVE-2024-45808Malicious log injection via access logs in envoy
- CVE-2024-45809Jwt filter crash in the clear route cache with remote JWKs in envoy
- CVE-2024-45810Envoy crashes for LocalReply in http async client