# envoy. Every CVE that names envoy among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)](https://agentprime.io/advisories/CVE-2026-73511.md) `CVE-2026-73511` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-289, CWE-436 - [Envoy: RBAC Authorization Bypass via Path Parameters](https://agentprime.io/advisories/CVE-2026-73553.md) `CVE-2026-73553` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-436 - [Envoy: Path normalization does not handle dot and dotdot segments with parameters](https://agentprime.io/advisories/CVE-2026-73551.md) `CVE-2026-73551` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-647 - [Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)](https://agentprime.io/advisories/CVE-2026-73546.md) `CVE-2026-73546` · CVE record: envoyproxy envoy · CVSS 7.4 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS) - [Envoy: use-after-free in QUIC on internal redirects](https://agentprime.io/advisories/CVE-2026-73512.md) `CVE-2026-73512` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption - [Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy](https://agentprime.io/advisories/CVE-2026-73550.md) `CVE-2026-73550` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Denial of service - [Envoy ext_authz: request \`:path\` pseudoheader dereferenced w/o null check](https://agentprime.io/advisories/CVE-2026-73547.md) `CVE-2026-73547` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption, CWE-20 - [Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null](https://agentprime.io/advisories/CVE-2026-48521.md) `CVE-2026-48521` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption - [Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters](https://agentprime.io/advisories/CVE-2026-73549.md) `CVE-2026-73549` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-754 - [Envoy: oghttp2 upstream trailers incorrect handling](https://agentprime.io/advisories/CVE-2026-73513.md) `CVE-2026-73513` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption, CWE-20 - [Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values](https://agentprime.io/advisories/CVE-2026-73552.md) `CVE-2026-73552` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-20 - [Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool](https://agentprime.io/advisories/CVE-2026-73548.md) `CVE-2026-73548` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: HTTP request smuggling - [Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault](https://agentprime.io/advisories/CVE-2026-50572.md) `CVE-2026-50572` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption - [Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)](https://agentprime.io/advisories/CVE-2026-48090.md) `CVE-2026-48090` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format](https://agentprime.io/advisories/CVE-2026-47220.md) `CVE-2026-47220` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides](https://agentprime.io/advisories/CVE-2026-47205.md) `CVE-2026-47205` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream](https://agentprime.io/advisories/CVE-2026-47692.md) `CVE-2026-47692` · CVE record: envoyproxy envoy · CVSS 4.8 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-130 - [Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message](https://agentprime.io/advisories/CVE-2026-47207.md) `CVE-2026-47207` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [Envoy Heap Buffer Overflow in TcpStatsdSink](https://agentprime.io/advisories/CVE-2026-48706.md) `CVE-2026-48706` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes](https://agentprime.io/advisories/CVE-2026-47204.md) `CVE-2026-47204` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [Envoy: Null pointer deref in internal redirects](https://agentprime.io/advisories/CVE-2026-47221.md) `CVE-2026-47221` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length](https://agentprime.io/advisories/CVE-2026-48743.md) `CVE-2026-48743` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: HTTP request smuggling - [Envoy: Abnormal process termination in DNS UDP filter](https://agentprime.io/advisories/CVE-2026-48497.md) `CVE-2026-48497` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-480 - [Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion](https://agentprime.io/advisories/CVE-2026-48044.md) `CVE-2026-48044` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-409 - [Envoy: Stack overflow in destructor of highly nested JSON](https://agentprime.io/advisories/CVE-2026-48042.md) `CVE-2026-48042` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-1124 - [Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)](https://agentprime.io/advisories/CVE-2026-47778.md) `CVE-2026-47778` · CVE record: envoyproxy envoy · CVSS 4.4 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-158 - [Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption](https://agentprime.io/advisories/CVE-2026-47775.md) `CVE-2026-47775` · CVE record: envoyproxy envoy · CVSS 6.8 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Weak cryptography or TLS - [Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification](https://agentprime.io/advisories/CVE-2026-47774.md) `CVE-2026-47774` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service, CWE-405, CWE-409 - [Envoy Query Parameter header_mutation.cc params.add injection](https://agentprime.io/advisories/CVE-2026-6994.md) `CVE-2026-6994` · CVE record: Envoy · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Other injection, CWE-707 - [Envoy Lua filter use-after-free when oversized rewritten response body causes crash](https://agentprime.io/advisories/CVE-2025-62504.md) `CVE-2025-62504` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Memory corruption - [Envoy allows large requests and responses to cause TCP connection pool crash](https://agentprime.io/advisories/CVE-2025-62409.md) `CVE-2025-62409` · CVE record: envoyproxy envoy · CVSS 6.6 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Memory corruption - [Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag](https://agentprime.io/advisories/CVE-2025-55162.md) `CVE-2025-55162` · CVE record: envoyproxy envoy · CVSS 6.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Authentication bypass - [Envoy vulnerable to bypass of RBAC uri_template permission](https://agentprime.io/advisories/CVE-2025-46821.md) `CVE-2025-46821` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2025 · Tags: CWE-186 - [HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy](https://agentprime.io/advisories/CVE-2024-53271.md) `CVE-2024-53271` · CVE record: envoyproxy envoy · CVSS 7.1 High · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-670 - [HTTP/1: sending overload crashes when the request is reset beforehand in envoy](https://agentprime.io/advisories/CVE-2024-53270.md) `CVE-2024-53270` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-670 - [Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy](https://agentprime.io/advisories/CVE-2024-53269.md) `CVE-2024-53269` · CVE record: envoyproxy envoy · CVSS 4.5 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-670 - [Potential manipulate \`x-envoy\` headers from external sources in envoy](https://agentprime.io/advisories/CVE-2024-45806.md) `CVE-2024-45806` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2024 · Tags: Broken access control - [oghttp2 crash on OnBeginHeadersForStream in envoy](https://agentprime.io/advisories/CVE-2024-45807.md) `CVE-2024-45807` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 19 Sept 2024 · Tags: CWE-670 - [Malicious log injection via access logs in envoy](https://agentprime.io/advisories/CVE-2024-45808.md) `CVE-2024-45808` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2024 · Tags: Other injection - [Jwt filter crash in the clear route cache with remote JWKs in envoy](https://agentprime.io/advisories/CVE-2024-45809.md) `CVE-2024-45809` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2024 · Tags: Memory corruption - [Envoy crashes for LocalReply in http async client](https://agentprime.io/advisories/CVE-2024-45810.md) `CVE-2024-45810` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2024 · Tags: Memory corruption - [Envoy Proxy use after free when route hash policy is configured with cookie attributes](https://agentprime.io/advisories/CVE-2024-39305.md) `CVE-2024-39305` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Memory corruption - [Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()](https://agentprime.io/advisories/CVE-2024-32974.md) `CVE-2024-32974` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: Memory corruption - [Envoy crashes in QuicheDataReader::PeekVarInt62Length()](https://agentprime.io/advisories/CVE-2024-32975.md) `CVE-2024-32975` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: Memory corruption - [Envoy can enter an endless loop while decompressing Brotli data with extra input](https://agentprime.io/advisories/CVE-2024-32976.md) `CVE-2024-32976` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 4 Jun 2024 · Tags: Denial of service - [Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream](https://agentprime.io/advisories/CVE-2024-34362.md) `CVE-2024-34362` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: Memory corruption - [Envoy can crash due to uncaught nlohmann JSON exception](https://agentprime.io/advisories/CVE-2024-34363.md) `CVE-2024-34363` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-248 - [Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response](https://agentprime.io/advisories/CVE-2024-34364.md) `CVE-2024-34364` · CVE record: envoyproxy envoy · CVSS 5.7 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: Denial of service - [Envoy incorrectly accepts HTTP 200 response for entering upgrade mode](https://agentprime.io/advisories/CVE-2024-23326.md) `CVE-2024-23326` · CVE record: envoyproxy envoy · CVSS 5.9 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-391 - [Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes](https://agentprime.io/advisories/CVE-2024-32475.md) `CVE-2024-32475` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 18 Apr 2024 · Tags: Denial of service, CWE-253 - [HTTP/2: CPU exhaustion due to CONTINUATION frame flood](https://agentprime.io/advisories/CVE-2024-30255.md) `CVE-2024-30255` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · EPSS 0.85 · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-390 - [HTTP/2: memory exhaustion due to CONTINUATION frame flood](https://agentprime.io/advisories/CVE-2024-27919.md) `CVE-2024-27919` · CVE record: envoyproxy envoy · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.84 · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-390 - [Envoy crashes when idle and request per try timeout occur within the backoff interval](https://agentprime.io/advisories/CVE-2024-23322.md) `CVE-2024-23322` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2024 · Tags: Memory corruption - [Excessive CPU usage when URI template matcher is configured using regex in Envoy](https://agentprime.io/advisories/CVE-2024-23323.md) `CVE-2024-23323` · CVE record: envoyproxy envoy · CVSS 4.3 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: Denial of service, CWE-1176 - [Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata](https://agentprime.io/advisories/CVE-2024-23324.md) `CVE-2024-23324` · CVE record: envoyproxy envoy · CVSS 8.6 High · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-20 - [Envoy crashes when using an address type that isn’t supported by the OS](https://agentprime.io/advisories/CVE-2024-23325.md) `CVE-2024-23325` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-248, CWE-755 - [Crash in proxy protocol when command type of LOCAL in Envoy](https://agentprime.io/advisories/CVE-2024-23327.md) `CVE-2024-23327` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2024 · Tags: Memory corruption - [Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes](https://agentprime.io/advisories/CVE-2023-35944.md) `CVE-2023-35944` · CVE record: envoyproxy envoy · CVSS 8.2 High · Not analysed yet · Published 25 Jul 2023 · Tags: CWE-20 - [Envoy vulnerable to CORS filter segfault when origin header is removed](https://agentprime.io/advisories/CVE-2023-35943.md) `CVE-2023-35943` · CVE record: envoyproxy envoy · CVSS 6.3 Medium · Not analysed yet · Published 25 Jul 2023 · Tags: Memory corruption - [Envoy's gRPC access log crash caused by the listener draining](https://agentprime.io/advisories/CVE-2023-35942.md) `CVE-2023-35942` · CVE record: envoyproxy envoy · CVSS 6.5 Medium · Not analysed yet · Published 25 Jul 2023 · Tags: Memory corruption Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .