Skip to content
OpenAdvisories

Package · Go

github.com/envoyproxy/envoy

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-26330

    Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with apply_on_stream_done in the rate limit configuration is enabled and the response phase limit reques…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 5.9
    CVE-2026-26311

    Envoy HTTP: filter chain execution on reset streams causing UAF crash

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP connection manager (FilterManager) that allows for Zombie Stream Filter Execution. This issue creates a "Use-After-Free"…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 5.9
    CVE-2026-26310

    Crash for scoped ip address in Envoy during DNS

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 5.3
    CVE-2026-26309

    Envoy has an off-by-one write in JsonEscaper::escapeString()

    Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to cras…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 5.0
    CVE-2025-66220

    Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHE…

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 6.5
    CVE-2025-64527

    Envoy crashes when JWT authentication is configured with the remote JWKS fetching

    Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in …

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 6.5
    CVE-2025-30157

    Envoy crashes when HTTP ext_proc processes local replies

    Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known …

    envoyproxy envoy github.com/envoyproxy/envoy Go
  • Medium 6.5
    CVE-2019-9901

    EnvoyProxy Envoy Missing HTTP URL path normalization

    Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an at…

    github.com/envoyproxy/envoy Go