CVE-2021-21378

Summary of CVE-2021-21378 (Envoy): In Envoy 1.17.0, the JWT Authentication filter can bypass authentication when configured with the allowed-missing option under requires_any, due to a faulty handling of an unknown issuer. A JwtUnknownIssuer error was mistakenly converted to JwtMissed, causing a ...

CVE-2021-32778

CVE-2021-32778 affects Envoy, where the HTTP/2 stream reset procedure has O(N^2) time complexity, causing high CPU and potential DoS when many streams are opened and closed. Connected advisories indicate fixes in Envoy versions 1.16.5, 1.17.4, 1.18.4, and 1.19.1, addressing the inefficiency. Othe...

CVE-2024-45809

Envoy CVE-2024-45809 describes a crash in the Jwt filter when remote JWKs are used and the route cache is cleared (clear_route_cache) while header operations can modify requests (e.g., header to claims). The root cause is the incorrect ordering of continueDecoding and clearRouteCache in upstream ...

CVE-2024-23327

CVE-2024-23327 affects Envoy: when PPv2 is enabled on a listener and a downstream cluster, the Envoy process can segfault while crafting the upstream PPv2 header if the downstream request uses a LOCAL command type and lacks a protocol block. This vulnerability is fixed in Envoy releases 1.29.1, 1...

CVE-2020-35471

Envoy prior to 1.16.1 is affected by CVE-2020-35471 due to mishandling dropped and truncated UDP datagrams, demonstrable as a segmentation fault when UDP packet size exceeds 1500. Publicly documented fixes indicate upgrading to a release containing the patch (e.g., OpenSUSE/SUSE advisories and OS...

CVE-2019-9901

CVE-2019-9901 affects Envoy 1.9.0 and earlier. The vulnerability arises because Envoy does not normalize HTTP URL paths, allowing a remote attacker to craft a relative path (e.g., something/../admin) to bypass access controls and cause a backend to interpret a non-normalized path, potentially gra...

CVE-2019-18801

CVE-2019-18801 affects Envoy 1.12.0 where an untrusted remote client can send HTTP/2 requests that write to the heap outside of request buffers when the upstream is HTTP/1, potentially causing heap corruption (query‑of‑death) or bypassing access controls like path-based routing. The vulnerability...

CVE-2023-35944

CVE-2023-35944 affects Envoy. The issue arises from case-sensitive internal HTTP/2 scheme checks, allowing mixed-case schemes (e.g., htTp, htTps) to be rejected or to bypass certain requests over unencrypted connections. The vulnerability exists prior to fixed releases and is mitigated by a patch...

CVE-2020-15104

CVE-2020-15104 describes a TLS certificate validation issue in Envoy prior to 1.12.6, 1.13.4, 1.14.4, and 1.15.0 where a wildcard DNS SAN could apply to multiple subdomains, e.g., *.example.com allowing nested.subdomain.example.com instead of only subdomain.example.com. The defect affects both cl...

CVE-2020-35470

CVE-2020-35470 — Envoy Proxy : This vulnerability arises in Envoy before 1.16.1, which logs an incorrect downstream address by only considering the directly connected peer instead of the information in the proxy protocol header. It affects scenarios using tcp-proxy as the network filter (not HTTP...

CVE-2023-35941

Envoy CVE-2023-35941 affects vulnerable OAuth2 filter handling across multiple pre-fix releases (Envoy 1.27.0, 1.26.4, 1.25.9, 1.24.10, 1.23.12 and earlier). The issue allows a malicious client to construct credentials with permanent validity in specific scenarios where HMAC payload validation co...

CVE-2019-9900

Technical details about CVE-2019-9900 are not provided in the connected documents. The initial description notes an issue in Envoy 1.9.0 and earlier with HTTP header parsing, but no public details are included here; monitor for updates.

CVE-2024-23326

CVE-2024-23326 is a vulnerability in Envoy (an open source cloud-native edge and service proxy) where a server can be tricked into adding an upgrade header in a response, causing request smuggling. The root cause is Envoy accepting a 200 response in a protocol upgrade flow (RFC 7230 §6.7 discusse...

CVE-2021-39162

CVE-2021-39162 affects Pomerium via its Envoy-based upstream processing. An H2 GOAWAY plus SETTINGS frame received in the same IO event can cause Envoy to terminate abnormally, leading to DoS when untrusted upstreams are present. The mitigation/patch is in version 0.15.1 (Envoy upgrade). If only ...

CVE-2026-48042

Envoy (open source edge and service proxy) contains a stack overflow vulnerability in the destructor of a JSON object when processing extremely nested structures. Affected versions are prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1. The issue is fixed in those same release lines (upgrade to 1.35.11...

CVE-2019-15226

CVE-2019-15226 affects Envoy: HTTP/1.x traffic (versions 1.10.0–1.11.1) and all HTTP/2 traffic. The header validation loop has O(n^2) complexity, enabling a remote attacker to construct many small headers below the maximum size to exhaust CPU and cause a denial of service. The available sources d...

CVE-2024-45808

CVE-2024-45808 affects the Envoy proxy and stems from insufficient validation of the REQUESTED_SERVER_NAME in access loggers, enabling potential log content manipulation. Affected versions are 1.31.2, 1.30.6, 1.29.9, and 1.28.7; upgrade to the fixed releases to remediate. The connected sources co...

CVE-2024-23325

CVE-2024-23325 concerns Envoy, a high‑performance proxy. The issue causes a crash in the Proxy protocol when an address type unsupported by the OS is observed; specifically, IPv6‑presented clients on hosts with IPv6 disabled and a listener with proxy protocol enabled can trigger a crash. The advi...

CVE-2020-25017

CVE-2020-25017 affects Envoy up to version 1.15.0. The vulnerability arises because when multiple HTTP header values are present, Envoy only considers the first value, and its header map API setCopy() does not replace all existing occurrences of a non-inline header. This behavior is described in ...

CVE-2021-39206

CVE-2021-39206 references Envoy vulnerabilities CVE-2021-32777 and CVE-2021-32779 within Pomerium. The issue can lead to incorrect authorization or routing decisions when path-prefix policy is used. Pomerium has patched Envoy in v0.14.8 and v0.15.1; mitigation also includes removing path-prefix p...

CVE-2019-18838

CVE-2019-18838 affects Envoy 1.12.0. A malformed HTTP request without a Host header causes an internally generated “Invalid request” response to be processed through the encoder filter chain; an encoder filter that accesses a request’s Host header can trigger a NULL pointer dereference, leading t...

CVE-2020-25018

CVE-2020-25018 concerns Envoy: a vulnerability in the Envoy master between commits 2d69e30 and 3b5acb2 where parsing of URLs requiring host canonicalization may fail. The issue is tied to host normalization during request handling, with multiple connected documents noting exposure leading to an a...

CVE-2021-39204

CVE-2021-39204 affects Pomerium (Envoy-based) where resetting HTTP/2 streams with excessive complexity can cause high CPU utilization and DoS. Affected versions include prior releases; remediation is to upgrade to Envoy-enabled binaries as used in Pomerium 0.14.8 and 0.15.1, which patch this vuln...

CVE-2024-39305

Envoy vulnerability CVE-2024-39305: In versions prior to 1.30.4, 1.29.7, 1.28.5, and 1.27.7, there is a use-after-free when route hash policy is configured with cookie attributes. During request processing Envoy may copy content from de-allocated memory into the request cookie header, potentially...

CVE-2024-23323

Envoy CVE-2024-23323 affects the Envoy proxy where the regex matcher is compiled per request, causing high CPU and increased latency when multiple routes use such matchers. The issue has specific fixes in released versions 1.29.1, 1.28.1, 1.27.3, and 1.26.7; upgrading is advised. The provided doc...

CVE-2024-34364

Envoy (the cloud-native proxy) is affected by CVE-2024-34364: an out-of-memory (OOM) condition caused by the async HTTP client buffering the mirror response with an unbounded buffer. This unbounded buffering can lead to memory exhaustion and potential DoS. Public documents attribute the issue to ...

CVE-2025-46821

CVE-2025-46821 concerns Envoy, a cloud-native edge/middle/service proxy. Affects prior releases up to 1.34.1, 1.33.3, 1.32.6, and 1.31.8 where the URI template matcher incorrectly excludes the * character in the URI path, causing URI templates to fail to match and potentially bypass RBAC rules co...

CVE-2024-32976

CVE-2024-32976 affects Envoy’s Brotli decompressor. The Brotli filter can enter an endless loop during decompression when given extra input, potentially enabling denial-of-service. Connected advisories note this issue alongside other Envoy CVEs and list mitigations that include upgrading Envoy to...

CVE-2024-53269

CVE-2024-53269 affects Envoy proxy. The issue occurs when the Happy Eyeballs sorting algorithm processes non-IP addresses in additional_address, causing a crash in the data plane. Root cause: invalid address types fed into the sort. Affected releases: 1.32.1/1.32.0? (per sources: 1.32.2, 1.31.4, ...

CVE-2024-53271

Envoy exposure CVE-2024-53271 affects the Envoy proxy where certain HTTP/1.1 non-101 1xx responses are not handled properly, causing downstream failures in networked devices. The issue has been fixed in releases 1.31.5 and 1.32.3. Public references across multiple feeds (Red Hat, SUSE, NVD, OSV, ...

CVE-2024-45807

CVE-2024-45807 affects Envoy 1.31.x where the default HTTP/2 codec is the oghttp implementation. The issue stems from bugs in stream management within oghttp2, which can cause Envoy to crash. A fix is available: upgrade to 1.31.2 (addressed in multiple advisories). Workarounds include disabling o...

CVE-2024-32975

CVE-2024-32975 affects Envoy’s QUIC stack. It describes a crash caused by an integer underflow in QuicStreamSequencerBuffer::PeekRegion(), leading to a crash at QuicheDataReader::PeekVarInt62Length(). The vulnerability is triggered by the underflow, resulting in a crash and potential denial of se...

CVE-2024-34363

CVE-2024-34363 affects Envoy, due to how Envoy invoked the nlohmann JSON library. The issue can cause an uncaught exception from downstream data when incomplete UTF-8 strings are serialized, leading to a process crash. The vulnerability is documented across multiple advisories and vendor analyses...

CVE-2024-32974

CVE-2024-32974 is a use-after-free in Envoy’s QUIC stack. A crash occurs in EnvoyQuicServerStream::OnInitialHeadersComplete() because QUICHE may push request headers after StopReading() and the HCM ActiveStream has been destroyed, risking use-after-free when QUICHE makes up calls. This can crash ...

CVE-2026-47220

The CVE describes a crash in Envoy when using %REQUESTED_SERVER_NAME(X:Y)% in log format with host-related options (e.g., HOST_FIRST, SNI_FIRST) and the specified host header is missing in the request headers. Affected versions are 1.37.0 through 1.37.5 and 1.38.3. The vulnerability arises from t...

CVE-2024-34362

CVE-2024-34362 affects Envoy’s QUIC stack: a use-after-free in HttpConnectionManager with EnvoyQuicServerStream can crash the process. Exploitation described as crafted request sequencing (no FIN, then RESET_STREAM, then close). No explicit exploit details in the Initial description; connected ad...

CVE-2026-48743

Envoy (open source edge/service proxy) contains a HTTP/3 to HTTP/1 request smuggling vulnerability prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. A downstream HTTP/3 request that is complete at the transport layer with a nonzero Content-Length can be mistranslated into a complete upstream...

CVE-2026-47778

Envoy CVE-2026-47778 describes a TLS DNS SAN truncation flaw in DefaultCertValidator::verifySubjectAltName. Before 1.35.11, 1.36.7, 1.37.3, and 1.38.1, an embedded NUL in a dNSName SAN can be partially preserved by generalNameAsString but truncated when converted to a C-style string via .c_str(),...

CVE-2026-47775

Envoy OAuth2 filter vulnerability (CVE-2026-47775): prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the encrypt()/decrypt() path uses AES-256-CBC without an authentication tag (no HMAC/AEAD), enabling a padding oracle via the /callback endpoint. An attacker with the encrypted CodeVerifier ...

CVE-2026-48497

CVE-2026-48497 affects Envoy and relates to the UDP DNS filter. Before versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a query with a DNS name of exactly 255 octets (local or remote resolution) can trigger abnormal process termination due to an invalid runtime precondition that the name must be str...

CVE-2026-47221

Envoy vulnerability CVE-2026-47221: the router filter has a null pointer dereference when handling internal redirects using HTTP 303 for body-less non-GET/HEAD requests. If a POST/PUT/DELETE/PATCH without a body targets a route with internal_redirect_policy including 303 and the upstream responds...

CVE-2026-26310

Envoy (the Envoy proxy) has a vulnerability CVE-2026-26310 where calling Utility::getAddressWithPort with scoped IPv6 addresses can crash the data plane via original_src/dns filters. Affected pre-1.37.1 releases (and some older branches) are fixed in versions 1.37.1, 1.36.5, 1.35.8, and 1.34.13. ...

CVE-2026-48706

CVE-2026-48706 affects Envoy TCP StatsD sink (TcpStatsdSink). A heap write overflow can occur when processing extremely long statistic names (>16 KiB) due to mismanagement of 16 KiB flush slices during buffer rotation, potentially causing process crash or remote code execution. Affected versio...

CVE-2026-47205

CVE-2026-47205 affects Envoy’s ext_authz HTTP filter. From 1.36.0 through 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) occurs when processing per-route authorization overrides concurrently with rapid downstream disconnects. The vulnerable flow creates a transient per-route client and reallo...

CVE-2026-48044

Summary: CVE-2026-48044 affects Envoy’s zstd decompressor (ZstdDecompressorImpl). From 1.23.0 through 1.35.11, 1.36.7, 1.37.3, and 1.38.1, specially crafted, highly compressed zstd payloads can trigger massive memory allocation when decompression is enabled, potentially causing memory exhaustion ...

CVE-2025-54588

Envoy DNS cache use-after-free in the Dynamic Forward Proxy (DFP) → triggers when a DNS resolution callback fires new resolutions or cancels existing ones, under specific conditions (DFP-enabled, envoy.reloadable_features.dfp_cluster_resolves_hosts enabled, and Host header modified between Dynami...

CVE-2025-55162

CVE-2025-55162 affects Envoy (OAuth2 filter). The issue is insufficient Session Expiration: when cookie names are __Secure- or __Host-, the filter fails to add the Secure attribute to the Set-Cookie header during deletion, causing cookies to persist and enabling session hijacking on shared machin...

CVE-2026-26309

Envoy CVE-2026-26309 describes an off-by-one write in Envoy::JsonEscaper::escapeString() that can corrupt std::string null-termination, causing undefined behavior and potentially crashes or out-of-bounds reads when treated as a C-string. Affected before 1.37.1, 1.36.5, 1.35.8, 1.34.13. The vulner...

CVE-2026-47204

Envoy CVE-2026-47204 affects the envoy.filters.http.grpc_stats filter. From 1.26.0 up to 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hitting a direct_response route could crash the Envoy process due to a nul...

CVE-2025-62504

Envoy Lua filter use-after-free is fixed in versions 1.36.2, 1.35.6, 1.34.10, and 1.33.12. The vulnerability occurs when a Lua script rewriting the response body causes the size to exceed per_connection_buffer_limit_bytes, leading to a local reply that can override headers and crash the process, ...