Envoyproxy Envoy vulnerabilities

CVE-2021-28682 [HIGH] CWE-190 CVE-2021-28682: An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.

CVE-2020-12604 [HIGH] CWE-401 CVE-2020-12604: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.

CVE-2024-32976 [HIGH] CWE-835 CVE-2024-32976: Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.

CVE-2020-8659 [HIGH] CWE-770 CVE-2020-8659: CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.

CVE-2020-8661 [HIGH] CWE-400 CVE-2020-8661: CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipe CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.

CVE-2021-29258 [HIGH] CWE-617 CVE-2021-29258: An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, b An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.

CVE-2021-28683 [HIGH] CWE-476 CVE-2021-28683: An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer derefe An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.

CVE-2020-8663 [HIGH] CWE-400 CVE-2020-8663: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when acce Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.

CVE-2020-12603 [HIGH] CWE-400 CVE-2020-12603: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxyin Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

CVE-2022-21655 [HIGH] CWE-670 CVE-2022-21655: Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy co Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the

CVE-2021-43825 [HIGH] CWE-416 CVE-2021-43825: Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a lo Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. How

CVE-2024-32975 [HIGH] CWE-191 CVE-2024-32975: Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader:: Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by integer underflow in the `QuicStreamSequencerBuffer::PeekRegion()` implementation.

CVE-2024-34363 [HIGH] CWE-248 CVE-2024-34363: Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann J Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash.

CVE-2025-66220 [HIGH] CWE-170 CVE-2025-66220: Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earl Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

CVE-2026-47207 [MEDIUM] CWE-416 CVE-2026-47207: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 u Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the first response in the batch causes the gRPC stream ob

CVE-2024-45808 [MEDIUM] CWE-117 CVE-2024-45808: Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identif Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.

CVE-2020-12605 [HIGH] CWE-770 CVE-2020-12605: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when process Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.

CVE-2026-48090 [MEDIUM] CWE-416 CVE-2026-48090: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 u Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can still invoke OAuth2Filter methods

CVE-2020-25018 [HIGH] CVE-2020-25018: Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicali Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.

CVE-2023-35942 [MEDIUM] CWE-416 CVE-2023-35942: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to vers Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a