en
Envoy Proxy is an open-source project that provides a high-performance Layer 7 edge, middle, and service proxy for cloud-native applications. It supports traffic routing, service-to-service communication, observability, policy enforcement, and extensibility, and is commonly deployed as an edge proxy, sidecar, or gateway in distributed systems.
As of 09/13/2026, envoyproxy recorded 15 security vulnerabilities in the last 90 days across 1 products, including 5 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, envoy had the most security vulnerabilities in the envoyproxy ecosystem, with 15 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-48090Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-47220Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityHigh |
CVE-2026-47205Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-47692Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-47207Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-48706Envoy Heap Buffer Overflow in TcpStatsdSink | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-47204Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-47221Envoy: Null pointer deref in internal redirects | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-48743Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityHigh |
CVE-2026-48497Envoy: Abnormal process termination in DNS UDP filter | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-48044Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published06/26/2026 | SeverityHigh |
CVE-2026-48042Envoy: Stack overflow in destructor of highly nested JSON | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityHigh |
CVE-2026-47778Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-47775Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published06/26/2026 | SeverityMedium |
CVE-2026-47774Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/17/2026 | SeverityHigh |
CVE-2026-26330Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published03/10/2026 | SeverityMedium |
CVE-2026-26311Envoy HTTP: filter chain execution on reset streams causing UAF crash | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published03/10/2026 | SeverityMedium |
CVE-2026-26310Crash for scoped ip address in Envoy during DNS | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published03/10/2026 | SeverityMedium |
CVE-2026-26309Envoy has an off-by-one write in JsonEscaper::escapeString() | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published03/10/2026 | SeverityMedium |
CVE-2026-26308Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published03/10/2026 | SeverityHigh |
CVE-2026-22771Envoy Extension Policy lua scripts injection causes arbitrary command execution | Exploitation statusNot known exploited | FixYes | Affected productgateway | Published01/12/2026 | SeverityHigh |
CVE-2025-66220Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published12/03/2025 | SeverityMedium |
CVE-2025-64763Envoy forwards early CONNECT data in TCP proxy mode | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published12/03/2025 | SeverityLow |
CVE-2025-64527Envoy crashes when JWT authentication is configured with the remote JWKS fetching | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published12/03/2025 | SeverityMedium |
CVE-2025-62504Envoy Lua filter use-after-free when oversized rewritten response body causes crash | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published10/16/2025 | SeverityMedium |
CVE-2025-62409Envoy allows large requests and responses to cause TCP connection pool crash | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published10/16/2025 | SeverityMedium |
CVE-2025-55162Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published09/03/2025 | SeverityMedium |
CVE-2025-54588Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published09/02/2025 | SeverityHigh |
CVE-2025-46821Envoy vulnerable to bypass of RBAC uri_template permission | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published05/07/2025 | SeverityMedium |
CVE-2025-30157Envoy crashes when HTTP ext_proc processes local replies | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published03/21/2025 | SeverityMedium |
CVE-2025-25294Envoy Gateway Log Injection Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productgateway | Published03/06/2025 | SeverityMedium |
CVE-2025-24030Envoy Admin Interface Exposed through prometheus metrics endpoint | Exploitation statusNot known exploited | FixNot confirmed | Affected productgateway | Published01/23/2025 | SeverityHigh |
CVE-2024-53271HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published12/18/2024 | SeverityHigh |
CVE-2024-53270HTTP/1: sending overload crashes when the request is reset beforehand in envoy | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published12/18/2024 | SeverityHigh |
CVE-2024-53269Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published12/18/2024 | SeverityMedium |
CVE-2024-45806Potential manipulate `x-envoy` headers from external sources in envoy | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published09/19/2024 | SeverityMedium |
CVE-2024-45807oghttp2 crash on OnBeginHeadersForStream in envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published09/19/2024 | SeverityHigh |
CVE-2024-45808Malicious log injection via access logs in envoy | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published09/19/2024 | SeverityMedium |
CVE-2024-45809Jwt filter crash in the clear route cache with remote JWKs in envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published09/19/2024 | SeverityMedium |
CVE-2024-45810Envoy crashes for LocalReply in http async client | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published09/19/2024 | SeverityMedium |
CVE-2024-39305Envoy Proxy use after free when route hash policy is configured with cookie attributes | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published07/01/2024 | SeverityMedium |
CVE-2024-32974Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete() | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/04/2024 | SeverityMedium |
CVE-2024-32975Envoy crashes in QuicheDataReader::PeekVarInt62Length() | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published06/04/2024 | SeverityMedium |
CVE-2024-32976Envoy can enter an endless loop while decompressing Brotli data with extra input | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published06/04/2024 | SeverityHigh |
CVE-2024-34362Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published06/04/2024 | SeverityMedium |
CVE-2024-34363Envoy can crash due to uncaught nlohmann JSON exception | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/04/2024 | SeverityHigh |
CVE-2024-34364Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/04/2024 | SeverityMedium |
CVE-2024-23326Envoy incorrectly accepts HTTP 200 response for entering upgrade mode | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/04/2024 | SeverityMedium |
CVE-2024-32475Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes | Exploitation statusNot known exploited | FixYes | Affected productenvoy | Published04/18/2024 | SeverityHigh |
CVE-2024-30255HTTP/2: CPU exhaustion due to CONTINUATION frame flood | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published04/04/2024 | SeverityMedium |
CVE-2024-27919HTTP/2: memory exhaustion due to CONTINUATION frame flood | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published04/04/2024 | SeverityHigh |
CVE-2024-23322Envoy crashes when idle and request per try timeout occur within the backoff interval | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/09/2024 | SeverityHigh |
CVE-2024-23323Excessive CPU usage when URI template matcher is configured using regex in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/09/2024 | SeverityMedium |
CVE-2024-23324Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/09/2024 | SeverityHigh |
CVE-2024-23325Envoy crashes when using an address type that isn’t supported by the OS | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/09/2024 | SeverityHigh |
CVE-2024-23327Crash in proxy protocol when command type of LOCAL in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/09/2024 | SeverityHigh |
CVE-2023-44487 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published10/10/2023 | SeverityHigh |
CVE-2023-35944Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published07/25/2023 | SeverityHigh |
CVE-2023-35943Envoy vulnerable to CORS filter segfault when origin header is removed | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published07/25/2023 | SeverityMedium |
CVE-2023-35942Envoy's gRPC access log crash caused by the listener draining | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published07/25/2023 | SeverityMedium |
CVE-2023-35941Envoy vulnerable to OAuth2 credentials exploit with permanent validity | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published07/25/2023 | SeverityHigh |
CVE-2023-35945Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published07/13/2023 | SeverityHigh |
CVE-2023-27496Envoy may crash when a redirect url without a state param is received in the oauth filter | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published04/04/2023 | SeverityMedium |
CVE-2023-27493Envoy doesn't escape HTTP header values | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published04/04/2023 | SeverityHigh |
CVE-2023-27492Envoy may crash when a large request body is processed in Lua filter | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published04/04/2023 | SeverityMedium |
CVE-2023-27491Envoy forwards invalid Http2/Http3 downstream headers | Exploitation statusPublic exploit | FixYes | Affected productenvoy | Published04/04/2023 | SeverityMedium |
CVE-2023-27488Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received. | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published04/04/2023 | SeverityMedium |
CVE-2023-27487Envoy client may fake the header `x-envoy-original-path` | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published04/04/2023 | SeverityHigh |
CVE-2022-29227Use after free in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/09/2022 | SeverityHigh |
CVE-2022-29226Trivial authentication bypass in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/09/2022 | SeverityCritical |
CVE-2022-29228Reachable assertion in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/09/2022 | SeverityHigh |
CVE-2022-29225Zip bomb vulnerability in Envoy | Exploitation statusPublic exploit | FixNot confirmed | Affected productenvoy | Published06/09/2022 | SeverityHigh |
CVE-2022-29224Segmentation fault leading to crash in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published06/09/2022 | SeverityMedium |
CVE-2021-43826Crash when tunneling TCP over HTTP in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityHigh |
CVE-2021-43825Use-after-free in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityMedium |
CVE-2022-21655Incorrect handling of internal redirects results in crash in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityHigh |
CVE-2022-21654Incorrect configuration handling allows TLS session re-use without re-validation in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityHigh |
CVE-2022-21657X.509 Extended Key Usage and Trust Purposes bypass in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityMedium |
CVE-2022-21656X.509 subjectAltName matching bypass in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityHigh |
CVE-2022-23606Crash when a cluster is deleted in Envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityMedium |
CVE-2021-43824Null pointer dereference in envoy | Exploitation statusNot known exploited | FixNot confirmed | Affected productenvoy | Published02/22/2022 | SeverityHigh |
CVE-2021-39206Incorrect Authorization with specially crafted requests | Exploitation statusNot confirmed | FixNot confirmed | Affected productpomerium | Published09/09/2021 | SeverityHigh |
CVE-2021-39204Excessive CPU usage in Pomerium | Exploitation statusNot confirmed | FixNot confirmed | Affected productpomerium | Published09/09/2021 | SeverityHigh |
CVE-2021-39162Incorrect handling of H2 GOAWAY + SETTINGS frames | Exploitation statusNot confirmed | FixNot confirmed | Affected productpomerium | Published09/09/2021 | SeverityHigh |
CVE-2021-32780Incorrect handling of H/2 GOAWAY followed by SETTINGS frames | Exploitation statusNot confirmed | FixNot confirmed | Affected productenvoy | Published08/24/2021 | SeverityHigh |
CVE-2021-32781Continued processing of requests after locally generated response | Exploitation statusNot confirmed | FixNot confirmed | Affected productenvoy | Published08/24/2021 | SeverityHigh |
CVE-2021-32779Incorrectly handling of URI '#fragment' element as part of the path element | Exploitation statusNot confirmed | FixNot confirmed | Affected productenvoy | Published08/24/2021 | SeverityHigh |
CVE-2021-32778Excessive CPU utilization when closing HTTP/2 streams | Exploitation statusNot confirmed | FixNot confirmed | Affected productenvoy | Published08/24/2021 | SeverityMedium |
CVE-2021-32777Incorrect concatenation of multiple value request headers in ext-authz extension | Exploitation statusNot confirmed | FixNot confirmed | Affected productenvoy | Published08/24/2021 | SeverityHigh |
CVE-2021-29492Bypass of path matching rules using escaped slash characters | Exploitation statusNot confirmed | FixNot confirmed | Affected productenvoy | Published05/28/2021 | SeverityHigh |
CVE-2021-29258 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2021 | SeverityUnknown |
CVE-2021-28683 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2021 | SeverityUnknown |
CVE-2021-28682 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2021 | SeverityUnknown |
CVE-2021-21378JWT authentication bypass with unknown issuer token | Exploitation statusNot confirmed | FixYes | Affected productenvoy | Published03/11/2021 | SeverityHigh |
CVE-2020-35470 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/15/2020 | SeverityUnknown |
CVE-2020-35471 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/15/2020 | SeverityUnknown |
CVE-2020-25018 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/01/2020 | SeverityUnknown |
CVE-2020-25017 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/01/2020 | SeverityUnknown |
CVE-2020-15104TLS Validation Vulnerability in Envoy | Exploitation statusNot confirmed | FixYes | Affected productenvoy | Published07/14/2020 | SeverityMedium |
CVE-2020-12605 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2020 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
