Envoyproxy Envoy
110 CVEs affecting Envoyproxy Envoy. Latest disclosed: 2026-06-26. Critical: 3, High: 58.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29226 | Critical | 10.0 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access… |
CVE-2019-18802 | Critical | 9.8 | 2019-12-13 | An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will… |
CVE-2019-18801 | Critical | 9.8 | 2019-12-13 | An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the ups… |
CVE-2020-35470 | High | 8.8 | 2020-12-15 | Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol heade… |
CVE-2024-23324 | High | 8.6 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid… |
CVE-2023-35941 | High | 8.6 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malici… |
CVE-2021-39206 | High | 8.6 | 2021-09-09 | Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 an… |
CVE-2021-39162 | High | 8.6 | 2021-09-09 | Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are rec… |
CVE-2021-32781 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a local… |
CVE-2021-32780 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 c… |
CVE-2021-32779 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled… |
CVE-2021-32777 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension… |
CVE-2020-25017 | High | 8.3 | 2020-10-01 | Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not re… |
CVE-2019-9900 | High | 8.3 | 2019-04-25 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting he… |
CVE-2023-35944 | High | 8.2 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme… |
CVE-2023-27487 | High | 8.2 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client… |
CVE-2021-21378 | High | 8.2 | 2021-03-11 | Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token wit… |
CVE-2023-27493 | High | 8.1 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does… |
CVE-2021-29492 | High | 8.1 | 2021-05-28 | Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and befor… |
CVE-2026-47220 | High | 7.5 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y… |