envoyproxy vulnerabilities (CVE)

9.2Critical

CVE-2026-111497 KEV 13 days ago

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Desigo CC family V8; Siemens Desigo CC family V9; Siemens Heliox Dual Port 60kW

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS

5.3Medium

CVE-2026-73511 1 month ago

Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters fr…

7.5High

CVE-2026-73553 1 month ago

Envoy: RBAC Authorization Bypass via Path Parameters

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RB…

5.3Medium

CVE-2026-73551 1 month ago

Envoy: Path normalization does not handle dot and dotdot segments with parameters

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such…

7.4High

CVE-2026-73546 1 month ago

Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic na…

7.5High

CVE-2026-73512 1 month ago

Envoy: use-after-free in QUIC on internal redirects

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including a…

7.5High

CVE-2026-73550 1 month ago

Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded val…

7.5High

CVE-2026-73547 1 month ago

Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_p…

5.9Medium

CVE-2026-48521 1 month ago

Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection…

5.3Medium

CVE-2026-73549 1 month ago

Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsS…

7.5High

CVE-2026-73513 1 month ago

Envoy: oghttp2 upstream trailers incorrect handling

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes an…

7.5High

CVE-2026-73552 1 month ago

Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A do…

7.5High

CVE-2026-73548 1 month ago

Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HT…

5.9Medium

CVE-2026-50572 1 month ago

Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClient…

7.4High

CVE-2026-53714 1 month ago

Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode

envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespac…

6.5Medium

CVE-2026-53716 1 month ago

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed o…

5.3Medium

CVE-2026-53715 1 month ago

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronizati…

6.5Medium

CVE-2026-53719 1 month ago

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, translateSecurityPolicyForRoute in internal/gatewayapi/securitypolicy.go dereferences a nil authorization value…

6.4Medium

CVE-2026-53718 1 month ago

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespac…

9.1Critical

CVE-2026-53713 1 month ago

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separa…

6.5Medium

CVE-2026-53717 1 month ago

Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

envoyproxy gateway

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values …

5.9Medium

CVE-2026-48090 4 months ago

Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has…

7.5High

CVE-2026-47220 4 months ago

Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

envoyproxy envoy; Red Hat OpenShift Service Mesh 2; Red Hat OpenShift Service Mesh 3

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's pos…

5.9Medium

CVE-2026-47205 4 months ago

Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.36.0 until 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability leading to a sudden segmentation fault exists in Envoy's ext_authz HTTP filter when proce…

4.8Medium

CVE-2026-47692 4 months ago

Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

envoyproxy envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between by…