Envoyproxy vulnerabilities
108 CVEs and advisories name Envoyproxy as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-39305Envoy Proxy use after free when route hash policy is configured with cookie attributes
- CVE-2024-32974Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()
- CVE-2024-32975Envoy crashes in QuicheDataReader::PeekVarInt62Length()
- CVE-2024-32976Envoy can enter an endless loop while decompressing Brotli data with extra input
- CVE-2024-34362Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream
- CVE-2024-34363Envoy can crash due to uncaught nlohmann JSON exception
- CVE-2024-34364Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response
- CVE-2024-23326Envoy incorrectly accepts HTTP 200 response for entering upgrade mode
- CVE-2024-32475Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes
- CVE-2024-30255HTTP/2: CPU exhaustion due to CONTINUATION frame flood
- CVE-2024-27919HTTP/2: memory exhaustion due to CONTINUATION frame flood
- CVE-2024-23322Envoy crashes when idle and request per try timeout occur within the backoff interval
- CVE-2024-23323Excessive CPU usage when URI template matcher is configured using regex in Envoy
- CVE-2024-23324Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata
- CVE-2024-23325Envoy crashes when using an address type that isn’t supported by the OS
- CVE-2024-23327Crash in proxy protocol when command type of LOCAL in Envoy
- CVE-2023-35944Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes
- CVE-2023-35943Envoy vulnerable to CORS filter segfault when origin header is removed
- CVE-2023-35942Envoy's gRPC access log crash caused by the listener draining
- CVE-2023-35941Envoy vulnerable to OAuth2 credentials exploit with permanent validity
- CVE-2023-35945Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
- CVE-2023-27496Envoy may crash when a redirect url without a state param is received in the oauth filter
- CVE-2023-27493Envoy doesn't escape HTTP header values
- CVE-2023-27492Envoy may crash when a large request body is processed in Lua filter
- CVE-2023-27491Envoy forwards invalid Http2/Http3 downstream headers
- CVE-2023-27488Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.
- CVE-2023-27487Envoy client may fake the header `x-envoy-original-path`
- CVE-2022-29227Use after free in Envoy
- CVE-2022-29226Trivial authentication bypass in Envoy
- CVE-2022-29228Reachable assertion in Envoy