What’s Vulnerable › Products

envoyproxy envoy vulnerabilities

126 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 45 published in the last 12 months.

Check whether your envoyproxy envoy version is affected

Exploited envoyproxy envoy vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability

Latest envoyproxy envoy vulnerabilities

• CVE-2026-73553 — Envoy: RBAC Authorization Bypass via Path Parameters (CVSS 7.5)
• CVE-2026-73551 — Envoy: Path normalization does not handle dot and dotdot segments with parameters (CVSS 5.3)
• CVE-2026-73511 — Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) (CVSS 5.3)
• CVE-2026-73552 — Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values (CVSS 7.5)
• CVE-2026-73550 — Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy (CVSS 7.5)
• CVE-2026-73549 — Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters (CVSS 5.3)
• CVE-2026-73548 — Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool (CVSS 7.5)
• CVE-2026-73547 — Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check (CVSS 7.5)
• CVE-2026-73546 — Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) (CVSS 7.4)
• CVE-2026-73513 — Envoy: oghttp2 upstream trailers incorrect handling (CVSS 7.5)
• CVE-2026-73512 — Envoy: use-after-free in QUIC on internal redirects (CVSS 7.5)
• CVE-2026-50572 — Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault (CVSS 5.9)
• CVE-2026-48521 — Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null (CVSS 5.9)
• CVE-2026-48090 — Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) (CVSS 5.9)
• CVE-2026-47220 — Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format (CVSS 7.5)
• CVE-2026-47205 — Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides (CVSS 5.9)
• CVE-2026-48743 — Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length (CVSS 7.5)
• CVE-2026-48706 — Envoy Heap Buffer Overflow in TcpStatsdSink (CVSS 7.5)
• CVE-2026-48497 — Envoy: Abnormal process termination in DNS UDP filter (CVSS 7.5)
• CVE-2026-48044 — Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion (CVSS 7.5)
• CVE-2026-48042 — Envoy: Stack overflow in destructor of highly nested JSON (CVSS 7.5)
• CVE-2026-47778 — Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) (CVSS 4.4)
• CVE-2026-47775 — Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption (CVSS 6.8)
• CVE-2026-47692 — Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream (CVSS 4.3)
• CVE-2026-47221 — Envoy: Null pointer deref in internal redirects (CVSS 7.5)