envoyproxy envoy
98 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-73511 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) p… | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-73553 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: RBAC Authorization Bypass via Path Parameters | HIGH 7.5 | 0.5 % | ||
| CVE-2026-73551 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: Path normalization does not handle dot and dotdot segments with parameters | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-73546 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) | HIGH 7.4 | 0.6 % | ||
| CVE-2026-73512 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: use-after-free in QUIC on internal redirects | HIGH 7.5 | 0.9 % | ||
| CVE-2026-73550 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy | HIGH 7.5 | 0.6 % | ||
| CVE-2026-73547 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check | HIGH 7.5 | 0.6 % | ||
| CVE-2026-48521 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null | MEDIUM 5.9 | 0.7 % | ||
| CVE-2026-73549 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-73513 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: oghttp2 upstream trailers incorrect handling | HIGH 7.5 | 0.5 % | ||
| CVE-2026-73552 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values | HIGH 7.5 | 0.5 % | ||
| CVE-2026-73548 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool | HIGH 7.5 | 0.5 % | ||
| CVE-2026-50572 | < 1.36.10 ; >= 1.37.0, < 1.37.6 ; >= 1.38.0, < 1.38.4 ; … | Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault | MEDIUM 5.9 | 0.7 % | ||
| CVE-2026-48090 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 | Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) | MEDIUM 5.9 | 0.6 % | ||
| CVE-2026-47220 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 | Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format | HIGH 7.5 | 0.7 % | ||
| CVE-2026-47205 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 ; >= 1.36.0, < 1.36.9 | Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-47692 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 ; >= 1.36.0, < 1.36.9 ; … | Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application… | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-47207 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 ; >= 1.36.0, < 1.36.9 ; … | Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-48706 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 ; >= 1.36.0, < 1.36.9 ; … | Envoy Heap Buffer Overflow in TcpStatsdSink | HIGH 7.5 | 0.6 % | ||
| CVE-2026-47204 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 ; >= 1.36.0, < 1.36.9 ; … | Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes | HIGH 7.5 | 0.4 % | ||
| CVE-2026-47221 | >= 1.38.0, < 1.38.3 ; >= 1.37.0, < 1.37.5 ; >= 1.36.0, < 1.36.9 ; … | Envoy: Null pointer deref in internal redirects | HIGH 7.5 | 0.4 % | ||
| CVE-2026-48743 | >= 1.38.0, < 1.38.1 ; >= 1.37.0, < 1.37.3 ; >= 1.36.0, < 1.36.7 ; … | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length | HIGH 7.5 | 0.3 % | ||
| CVE-2026-48497 | >= 1.38.0, < 1.38.1 ; >= 1.37.0, < 1.37.3 ; >= 1.36.0, < 1.36.7 ; … | Envoy: Abnormal process termination in DNS UDP filter | HIGH 7.5 | 0.4 % | ||
| CVE-2026-48044 | >= 1.38.0, < 1.38.1 ; >= 1.37.0, < 1.37.3 ; >= 1.36.0, < 1.36.7 ; … | Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion | HIGH 7.5 | 0.5 % | ||
| CVE-2026-48042 | >= 1.38.0, < 1.38.1 ; >= 1.37.0, < 1.37.3 ; >= 1.36.0, < 1.36.7 ; … | Envoy: Stack overflow in destructor of highly nested JSON | HIGH 7.5 | 0.6 % | ||
| CVE-2026-47778 | >= 1.38.0, < 1.38.1 ; >= 1.37.0, < 1.37.3 ; >= 1.36.0, < 1.36.7 ; … | Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-47775 | >= 1.38.0, < 1.38.1 ; >= 1.37.0, < 1.37.3 ; >= 1.36.0, < 1.36.7 ; … | Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-47774 | < 1.35.11 ; >= 1.36.0, < 1.36.7 ; >= 1.37.0, < 1.37.3 ; … | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification | HIGH 7.5 | 1.0 % | ||
| CVE-2026-26330 | >= 1.37.0, < 1.37.1 ; >= 1.36.0, < 1.36.5 ; >= 1.35.0, < 1.35.9 ; … | Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly | HIGH 7.5 | 0.3 % | ||
| CVE-2026-26311 | >= 1.37.0, < 1.37.1 ; >= 1.36.0, < 1.36.5 ; >= 1.35.0, < 1.35.9 ; … | Envoy HTTP: filter chain execution on reset streams causing UAF crash | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-26310 | >= 1.37.0, < 1.37.1 ; >= 1.36.0, < 1.36.5 ; >= 1.35.0, < 1.35.9 ; … | Crash for scoped ip address in Envoy during DNS | HIGH 7.5 | 0.4 % | ||
| CVE-2026-26309 | >= 1.37.0, < 1.37.1 ; >= 1.36.0, < 1.36.5 ; >= 1.35.0, < 1.35.9 ; … | Envoy has an off-by-one write in JsonEscaper::escapeString() | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-26308 | >= 1.37.0, < 1.37.1 ; >= 1.36.0, < 1.36.5 ; >= 1.35.0, < 1.35.9 ; … | Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation | HIGH 8.2 | 0.3 % | ||
| CVE-2025-66220 | >= 1.36.0, <= 1.36.2 ; >= 1.35.0, <= 1.35.6 ; >= 1.34.0, <= 1.34.10 ; … | Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte | HIGH 7.1 | 0.2 % | ||
| CVE-2025-64763 | >= 1.36.0, <= 1.36.2 ; >= 1.35.0, <= 1.35.6 ; >= 1.34.0, <= 1.34.10 ; … | Envoy forwards early CONNECT data in TCP proxy mode | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-64527 | >= 1.36.0, <= 1.36.2 ; >= 1.35.0, <= 1.35.6 ; >= 1.34.0, <= 1.34.10 ; … | Envoy crashes when JWT authentication is configured with the remote JWKS fetching | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-62504 | >= 1.36.0, <= 1.36.1 ; >= 1.350, <= 1.35.5 ; >= 1.34.0, <= 1.34.9 ; … | Envoy Lua filter use-after-free when oversized rewritten response body causes crash | HIGH 7.5 | 0.4 % | ||
| CVE-2025-62409 | >= 1.36.0, < 1.36.1 ; >= 1.35.0, < 1.35.5 ; >= 1.34.0, < 1.34.9 ; … | Envoy allows large requests and responses to cause TCP connection pool crash | MEDIUM 6.6 | 0.5 % | ||
| CVE-2025-55162 | >= 1.35.0, < 1.35.1 ; >= 1.34.0, < 1.34.5 ; >= 1.33.0, < 1.33.7 ; … | Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag | HIGH 8.8 | 0.3 % | ||
| CVE-2025-54588 | >= 1.34.0, < 1.34.5 ; >= 1.35.0, < 1.35.1 | Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults | HIGH 7.5 | 0.5 % | ||
| CVE-2025-46821 | < 1.31.8 ; >= 1.32.0, < 1.32.6 ; >= 1.33.0, < 1.33.3 ; … | Envoy vulnerable to bypass of RBAC uri_template permission | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-30157 | >= 1.33.0, < 1.33.1 ; >= 1.32.0, < 1.32.4 ; >= 1.31.0, < 1.31.6 ; … | Envoy crashes when HTTP ext_proc processes local replies | HIGH 7.5 | 0.4 % | ||
| CVE-2024-53271 | >= 1.31.0, < 1.31.5 ; >= 1.32.0, < 1.32.3 | HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy | HIGH 7.1 | 0.6 % | ||
| CVE-2024-53270 | >= 1.32.0, < 1.32.3 ; >= 1.31.0, < 1.31.5 ; >= 1.30.0, < 1.30.9 ; … | HTTP/1: sending overload crashes when the request is reset beforehand in envoy | HIGH 7.5 | 0.7 % | ||
| CVE-2024-53269 | >= 1.32.0, < 1.32.2 ; >= 1.31.0, < 1.31.4 ; >= 1.30.0, < 1.30.8 | Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy | HIGH 7.5 | 0.7 % | ||
| CVE-2024-45806 | >= 1.31.0, < 1.31.2 ; >= 1.30.0, < 1.30.6 ; >= 1.29.0, < 1.29.9 ; … | Potential manipulate `x-envoy` headers from external sources in envoy | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-45807 | >= 1.31.0, < 1.31.2 | oghttp2 crash on OnBeginHeadersForStream in envoy | HIGH 7.5 | 0.5 % | ||
| CVE-2024-45808 | >= 1.31.0, < 1.31.2 ; >= 1.30.0, < 1.30.6 ; >= 1.29.0, < 1.29.9 ; … | Malicious log injection via access logs in envoy | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-45809 | >= 1.29.0, < 1.29.9 ; >= 1.30.0, < 1.30.6 ; >= 1.31.0, < 1.31.2 | Jwt filter crash in the clear route cache with remote JWKs in envoy | HIGH 7.5 | 0.4 % | ||
| CVE-2024-45810 | < 1.28.7 ; >= 1.29.0, < 1.29.9 ; >= 1.30.0, < 1.30.6 ; … | Envoy crashes for LocalReply in http async client | HIGH 7.5 | 0.6 % | ||
| CVE-2024-39305 | >= 1.30.0, < 1.30.4 ; >= 1.29.0, < 1.29.7 ; >= 1.28.0, < 1.28.5 ; … | Envoy Proxy use after free when route hash policy is configured with cookie attributes | CRITICAL 9.1 | 0.6 % | ||
| CVE-2024-32974 | >= 1.30.0, <= 11.30.1 ; >= 1.29.0, <= 1.29.4 ; >= 1.28.0, <= 1.28.3 ; … | Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete() | HIGH 7.5 | 0.7 % | ||
| CVE-2024-32975 | >= 1.30.0, <= 11.30.1 ; >= 1.29.0, <= 1.29.4 ; >= 1.28.0, <= 1.28.3 ; … | Envoy crashes in QuicheDataReader::PeekVarInt62Length() | HIGH 7.5 | 0.7 % | ||
| CVE-2024-32976 | >= 1.30.0, <= 11.30.1 ; >= 1.29.0, <= 1.29.4 ; >= 1.28.0, <= 1.28.3 ; … | Envoy can enter an endless loop while decompressing Brotli data with extra input | HIGH 7.5 | 0.7 % | ||
| CVE-2024-34362 | >= 1.30.0, <= 11.30.1 ; >= 1.29.0, <= 1.29.4 ; >= 1.28.0, <= 1.28.3 ; … | Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream | MEDIUM 5.9 | 0.6 % | ||
| CVE-2024-34363 | >= 1.30.0, <= 11.30.1 ; >= 1.29.0, <= 1.29.4 ; >= 1.28.0, <= 1.28.3 | Envoy can crash due to uncaught nlohmann JSON exception | HIGH 7.5 | 0.7 % | ||
| CVE-2024-34364 | >= 1.30.0, <= 11.30.1 ; >= 1.29.0, <= 1.29.4 ; >= 1.28.0, <= 1.28.3 ; … | Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-23326 | >= 1.13.0, <= 1.30.1 ; >= 1.29.0, <= 1.29.4 ; >= 1.28.0, <= 1.28.3 ; … | Envoy incorrectly accepts HTTP 200 response for entering upgrade mode | HIGH 8.2 | 0.4 % | ||
| CVE-2024-32475 | >= 1.30.0, < 11.30.1 ; >= 1.29.0, < 1.29.4 ; >= 1.28.0, < 1.28.3 ; … | Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes | HIGH 7.5 | 0.7 % | ||
| CVE-2024-30255 | >= 1.29.0, < 1.29.3 ; >= 1.28.0, < 1.28.2 ; >= 1.27.0, < 1.27.4 ; … | HTTP/2: CPU exhaustion due to CONTINUATION frame flood | HIGH 7.5 | 88 % | ||
| CVE-2024-27919 | >= 1.29.0, < 1.29.2 | HTTP/2: memory exhaustion due to CONTINUATION frame flood | HIGH 7.5 | 87 % | ||
| CVE-2024-23322 | >= 1.29.0, < 1.29.1 ; >= 1.28.0, < 1.28.1 ; >= 1.27.0, < 1.27.3 ; … | Envoy crashes when idle and request per try timeout occur within the backoff interval | HIGH 7.5 | 0.7 % | ||
| CVE-2024-23323 | >= 1.29.0, < 1.29.1 ; >= 1.28.0, < 1.28.1 ; >= 1.27.0, < 1.27.3 ; … | Excessive CPU usage when URI template matcher is configured using regex in Envoy | MEDIUM 5.3 | 0.5 % | ||
| CVE-2024-23324 | >= 1.29.0, < 1.29.1 ; >= 1.28.0, < 1.28.1 ; >= 1.27.0, < 1.27.3 ; … | Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata | HIGH 8.6 | 0.6 % | ||
| CVE-2024-23325 | >= 1.29.0, < 1.29.1 ; >= 1.28.0, < 1.28.1 ; >= 1.27.0, < 1.27.3 ; … | Envoy crashes when using an address type that isn’t supported by the OS | HIGH 7.5 | 0.8 % | ||
| CVE-2024-23327 | >= 1.29.0, < 1.29.1 ; >= 1.28.0, < 1.28.1 ; >= 1.27.0, < 1.27.3 ; … | Crash in proxy protocol when command type of LOCAL in Envoy | HIGH 7.5 | 0.7 % | ||
| CVE-2023-35944 | >= 1.26.0, < 1.26.4 ; >= 1.25.0, < 1.25.9 ; >= 1.24.0, < 1.24.10 ; … | Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes | HIGH 8.2 | 0.7 % | ||
| CVE-2023-35943 | >= 1.26.0, < 1.26.4 ; >= 1.25.0, < 1.25.9 ; >= 1.24.0, < 1.24.10 ; … | Envoy vulnerable to CORS filter segfault when origin header is removed | HIGH 7.5 | 0.7 % | ||
| CVE-2023-35942 | >= 1.26.0, < 1.26.4 ; >= 1.25.0, < 1.25.9 ; >= 1.24.0, < 1.24.10 ; … | Envoy's gRPC access log crash caused by the listener draining | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-35941 | >= 1.26.0, < 1.26.4 ; >= 1.25.0, < 1.25.9 ; >= 1.24.0, < 1.24.10 ; … | Envoy vulnerable to OAuth2 credentials exploit with permanent validity | CRITICAL 9.8 | 0.8 % | ||
| CVE-2023-35945 | >= 1.26.0, < 1.26.3 ; >= 1.25.0, < 1.25.8 ; >= 1.24.0, < 1.24.9 ; … | Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec | HIGH 7.5 | 1.7 % | ||
| CVE-2023-27496 | >= 1.25.0, < 1.25.3 ; >= 1.24.0, < 1.24.4 ; >= 1.23.0, < 1.23.6 ; … | Envoy may crash when a redirect url without a state param is received in the oauth filter | HIGH 7.5 | 0.8 % | ||
| CVE-2023-27493 | >= 1.25.0, < 1.25.3 ; >= 1.24.0, < 1.24.4 ; >= 1.23.0, < 1.23.6 ; … | Envoy doesn't escape HTTP header values | CRITICAL 9.1 | 0.5 % | ||
| CVE-2023-27492 | >= 1.25.0, < 1.25.3 ; >= 1.24.0, < 1.24.4 ; >= 1.23.0, < 1.23.6 ; … | Envoy may crash when a large request body is processed in Lua filter | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-27491 | >= 1.25.0, < 1.25.3 ; >= 1.24.0, < 1.24.4 ; >= 1.23.0, < 1.23.6 ; … | Envoy forwards invalid Http2/Http3 downstream headers | CRITICAL 9.1 | 0.9 % | ||
| CVE-2023-27488 | >= 1.25.0, <1.25.3 ; >= 1.24.0, < 1.24.4 ; >= 1.23.0, < 1.23.6 ; … | Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received. | CRITICAL 9.8 | 0.7 % | ||
| CVE-2023-27487 | >= 1.25.0, <1.25.3 ; >= 1.24.0, < 1.24.4 ; >= 1.23.0, < 1.23.6 ; … | Envoy client may fake the header `x-envoy-original-path` | CRITICAL 9.1 | 0.6 % | ||
| CVE-2022-29227 | < 1.22.1 | Use after free in Envoy | HIGH 7.5 | 1.2 % | ||
| CVE-2022-29226 | < 1.22.1 | Trivial authentication bypass in Envoy | CRITICAL 10.0 | 1.3 % | ||
| CVE-2022-29228 | < 1.22.1 | Reachable assertion in Envoy | HIGH 7.5 | 1.3 % | ||
| CVE-2022-29225 | < 1.22.1 | Zip bomb vulnerability in Envoy | HIGH 7.5 | 1.6 % | ||
| CVE-2022-29224 | < 1.22.1 | Segmentation fault leading to crash in Envoy | MEDIUM 5.9 | 1.0 % | ||
| CVE-2021-43826 | < 1.18.6 ; >= 1.19.0, < 1.19.3 ; >= 1.20.0, < 1.20.2 ; … | Crash when tunneling TCP over HTTP in Envoy | HIGH 7.5 | 1.1 % | ||
| CVE-2021-43825 | < 1.18.6 ; >= 1.19.0, < 1.19.3 ; >= 1.20.0, < 1.20.2 ; … | Use-after-free in Envoy | HIGH 7.5 | 0.9 % | ||
| CVE-2022-21655 | < 1.18.6 ; >= 1.19.0, < 1.19.3 ; >= 1.20.0, < 1.20.2 ; … | Incorrect handling of internal redirects results in crash in Envoy | HIGH 7.5 | 1.1 % | ||
| CVE-2022-21654 | >= 1.7.0, < 1.18.6 ; >= 1.19.0, < 1.19.3 ; >= 1.20.0, < 1.20.2 ; … | Incorrect configuration handling allows TLS session re-use without re-validation in Envoy | CRITICAL 9.8 | 1.1 % | ||
| CVE-2022-21657 | >= 1.20.0, < 1.20.2 ; >= 1.19.0, < 1.19.3 ; < 1.18.6 | X.509 Extended Key Usage and Trust Purposes bypass in Envoy | MEDIUM 6.8 | 0.5 % | ||
| CVE-2022-21656 | < 1.20.2 | X.509 subjectAltName matching bypass in Envoy | HIGH 7.4 | 0.7 % | ||
| CVE-2022-23606 | >= 1.20.0, < 1.20.2 ; >= 1.21.0, < 1.21.1 | Crash when a cluster is deleted in Envoy | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-43824 | >= 1.20.0, < 1.20.2 ; >= 1.19.0, < 1.19.3 ; < 1.18.6 ; … | Null pointer dereference in envoy | HIGH 7.5 | 1.1 % | ||
| CVE-2021-32780 | >= 1.19.0, < 1.19.1 ; >= 1.18.0, < 1.18.4 | Incorrect handling of H/2 GOAWAY followed by SETTINGS frames | HIGH 8.6 | 1.2 % | ||
| CVE-2021-32781 | >= 1.19.0, < 1.19.1 ; >= 1.18.0, < 1.18.4 ; >= 1.17.0, < 1.17.4 ; … | Continued processing of requests after locally generated response | HIGH 8.6 | 1.3 % | ||
| CVE-2021-32779 | >= 1.19.0, < 1.19.1 ; >= 1.18.0, < 1.18.4 ; >= 1.17.0, < 1.17.4 ; … | Incorrectly handling of URI '#fragment' element as part of the path element | HIGH 8.6 | 0.9 % | ||
| CVE-2021-32778 | >= 1.19.0, < 1.19.1 ; >= 1.18.0, < 1.18.4 ; >= 1.17.0, < 1.17.4 ; … | Excessive CPU utilization when closing HTTP/2 streams | HIGH 7.5 | 1.2 % | ||
| CVE-2021-32777 | >= 1.19.0, < 1.19.1 ; >= 1.18.0, < 1.18.4 ; >= 1.17.0, < 1.17.4 ; … | Incorrect concatenation of multiple value request headers in ext-authz extension | HIGH 8.6 | 3.3 % | ||
| CVE-2021-29492 | <= 1.18.2 | Bypass of path matching rules using escaped slash characters | HIGH 8.3 | 63 % | ||
| CVE-2021-21378 | = 1.17.0 | JWT authentication bypass with unknown issuer token | HIGH 8.2 | 1.7 % | ||
| CVE-2020-15104 | < 1.12.6 ; >= 1.13.0, < 1.13.4 ; >= 1.14.0, < 1.14.4 | TLS Validation Vulnerability in Envoy | MEDIUM 5.4 | 0.3 % |