What’s Vulnerable › Vulnerabilities
CVE-2025-66220: Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
- Severity: high (CVSS 7.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-12-03 · updated 2026-09-25
- Weakness: CWE-170
Description
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
Affected products
- envoyproxy envoy: before 1.33.13; from 1.34.0 before 1.34.11; from 1.35.0 before 1.35.7; from 1.36.0 before 1.36.3 — fixed in 1.33.13, 1.34.11, 1.35.7, 1.36.3
How to fix
Upgrade to a fixed version: envoyproxy envoy 1.33.13, 1.34.11, 1.35.7, 1.36.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-66220 or the next vulnerability affects your stack