Envoyproxy Envoy vulnerabilities

CVE-2026-26308 [HIGH] CWE-863 CVE-2026-26308: Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all va

CVE-2026-73546 [HIGH] CWE-79 CVE-2026-73546: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods

CVE-2019-9900 [HIGH] CWE-74 CVE-2019-9900: When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

CVE-2019-18802 [CRITICAL] CVE-2019-18802: An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.

CVE-2026-73548 [HIGH] CWE-444 CVE-2026-73548: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades t

CVE-2021-32779 [HIGH] CWE-551 CVE-2021-32779: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented ar Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or

CVE-2024-23326 [HIGH] CWE-391 CVE-2024-23326: Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnera Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a

CVE-2026-47774 [HIGH] CWE-405 CVE-2026-47774: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to vers Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and

CVE-2022-21654 [CRITICAL] CWE-295 CVE-2022-21654: Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

CVE-2026-73547 [HIGH] CWE-20 CVE-2026-73547: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_h

CVE-2026-47221 [HIGH] CWE-476 CVE-2026-47221: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 u Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. When a POST, PUT, DELETE, or PATCH request without a

CVE-2026-73552 [HIGH] CWE-20 CVE-2026-73552: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing R

CVE-2021-39162 [HIGH] CWE-754 CVE-2021-39162: Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnor Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upst

CVE-2026-73512 [HIGH] CWE-416 CVE-2026-73512: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not

CVE-2026-48743 [HIGH] CWE-444 CVE-2026-48743: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unre

CVE-2026-47220 [HIGH] CWE-476 CVE-2026-47220: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 u Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vu

CVE-2026-48042 [HIGH] CWE-1124 CVE-2026-48042: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

CVE-2026-73513 [HIGH] CWE-20 CVE-2026-73513: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamI

CVE-2020-35470 [HIGH] CVE-2020-35470: Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly conn Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).

CVE-2026-73550 [HIGH] CWE-401 CVE-2026-73550: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits.