Envoyproxy Envoy vulnerabilities

CVE-2020-15104 [MEDIUM] CWE-346 CVE-2020-15104: In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This de

CVE-2020-8660 [MEDIUM] CWE-345 CVE-2020-8660: CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recogniz CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.

CVE-2024-23323 [MEDIUM] CWE-400 CVE-2024-23323: Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every re Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known

CVE-2026-47778 [MEDIUM] CWE-158 CVE-2026-47778: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural flaw was identified in DefaultCertValidator::verifySubjectAltName where the extracted DNS SAN string is cast to a C-style string using .c_str() before being passed to the Utility::dnsNameMatch() algorithm.

CVE-2026-47692 [MEDIUM] CWE-130 CVE-2026-47692: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 u Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the ups

CVE-2020-11767 [LOW] CVE-2020-11767: Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (n Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request for a domain concurrently configured explicitly (e.g., abc.example.com) is sent to the server(s) listening behind *.example.com. The outcome should instead be 421 Misdirected Request. Imagine a shared ca