EUVD-2026-10802

Envoy vulenrable to crash for scoped ip address during DNS...

GHSA-3CW6-2J68-868P Envoy vulnerable to crash for scoped ip address during DNS

Summary Calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the originalsrc filter and the dns filter. Details The crashing function is Utility::getAddressWithPort. The crash occurs if a string containing a scoped IPv6...

Envoy vulnerable to crash for scoped ip address during DNS

Summary Calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the originalsrc filter and the dns filter. Details The crashing function is Utility::getAddressWithPort. The crash occurs if a string containing a scoped IPv6...

CVE-2026-26311

creationtimestamp| type| source ---|---|--- 2026-03-10 16:05:37+00:00| published-proof-of-concept| https://github.com/envoyproxy/envoy/security/advisories/GHSA-84xm-r438-86px...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: opencost, etcd, cert-manager-webhook-pdns-fips, skaffold-fips, terraform-provider-tls-fips, syncthing-fips, cluster-proportional-autoscaler, rke2-cloud-provider-fips, syncthing, k9s-fips, aws-nuke, dex, prometheus-adapter, gitlab-pages, falco-exporter-fips,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: opencost, etcd, cert-manager-webhook-pdns-fips, skaffold-fips, terraform-provider-tls-fips, rke2-cloud-provider-fips, k9s-fips, dex, prometheus-adapter, gitlab-pages, falco-exporter-fips, nemo, tetragon-fips, grpc-health-probe-fips, coredns, ksops, knative-operator,...

Envoy 输入验证错误漏洞

Envoy is an open-source gateway program developed by Enphase for connecting smart home devices. Versions of Envoy prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contained a vulnerability related to input validation errors. This vulnerability occurred when the Utility::getAddressWithPort function wa...

Envoy 资源管理错误漏洞

Envoy is an open-source gateway program developed by Enphase for connecting smart home devices. Versions of Envoy prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contain a resource management vulnerability. This vulnerability stems from logical flaws in the HTTP connection manager, which may lead to...

Envoy 安全漏洞

Envoy is an open-source gateway program developed by Enphase for connecting smart home devices. There are security vulnerabilities in versions of Envoy prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13. These vulnerabilities stem from logical flaws in the role-based access control filter, which may...

PT-2026-24617

Summary An off-by-one write in Envoy::JsonEscaper::escapeString can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. Details The bug is in the control-character...

PT-2026-24378

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.34.13 Envoy versions prior to 1.35.8 Envoy versions prior to 1.36.5 Envoy versions prior to 1.37.1 Description Envoy is a high-performance edge/middle/service proxy. An off-by-one write in the...

PT-2026-24379

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.37.1 Envoy versions prior to 1.36.5 Envoy versions prior to 1.35.8 Envoy versions prior to 1.34.13 Description Envoy is a high-performance edge/middle/service proxy. Calling the Utility::getAddressWithPort function wi...

PT-2026-24622

Note: This vulnerability was originally reported to the Google OSS VRP Issue ID: 477542544. The Google Security Team requested that I coordinate directly with the Envoy maintainers for triage and remediation. I am submitting this report here to facilitate that process. Technical Details I have...

Envoy 资源管理错误漏洞

Envoy is an open-source gateway program developed by Enphase for connecting smart home devices. Versions of Envoy prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13 contain a resource management vulnerability. This vulnerability stems from improper cleanup of internal state within the rate-limiting...

PT-2026-24377

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.37.1 Envoy versions prior to 1.36.5 Envoy versions prior to 1.35.8 Envoy versions prior to 1.34.13 Description Envoy is a high-performance edge/middle/service proxy. The Envoy RBAC Role-Based Access Control filter has...

PT-2026-24626

Summary The Envoy RBAC Role-Based Access Control filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated...

Envoy 安全漏洞

Envoy is an open-source gateway program developed by Enphase, used to connect smart home devices. There are security vulnerabilities in versions of Envoy prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13. These vulnerabilities stem from a race condition in the JsonEscaper::escapeString function, which...

Istio 安全漏洞

Istio is an open-source platform that connects, manages, and protects microservices. There are security vulnerabilities in versions of Istio prior to 1.29.1, 1.28.5, and 1.27.8. These vulnerabilities stem from defects in the Envoy RBAC header matching mechanism, which may allow authorization...

PT-2026-24380

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.34.13 Envoy versions 1.35.0 through 1.35.7 Envoy versions 1.36.0 through 1.36.4 Envoy versions 1.37.0 Description Envoy is a high-performance edge/middle/service proxy. A logic issue exists in Envoy’s HTTP connection...

PT-2026-24401

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.34.13 Envoy versions prior to 1.35.8 Envoy versions prior to 1.36.5 Envoy versions prior to 1.37.1 Description Envoy is a high-performance edge/middle/service proxy. A crash may occur in the rate limit filter when the...