What’s Vulnerable › Vulnerabilities

CVE-2022-21654: Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-22 · updated 2026-06-17
• Weakness: CWE-295

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Affected products

• envoyproxy envoy: from 1.7.0 before 1.18.6; from 1.19.0 before 1.19.3; from 1.20.0 before 1.20.2; from 1.21.0 before 1.21.1 — fixed in 1.18.6, 1.19.3, 1.20.2, 1.21.1

How to fix

Upgrade to a fixed version: envoyproxy envoy 1.18.6, 1.19.3, 1.20.2, 1.21.1. Check the vendor advisory for mitigations.

References

• https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
• https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283

Get alerted when CVE-2022-21654 or the next vulnerability affects your stack