envoy.

Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

• envoy
• CWE-289
• CWE-436

Envoy: RBAC Authorization Bypass via Path Parameters

• envoy
• CWE-436

Envoy: Path normalization does not handle dot and dotdot segments with parameters

• envoy
• CWE-647

Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

• envoy
• Cross-site scripting (XSS)

Envoy: use-after-free in QUIC on internal redirects

• envoy
• Memory corruption

Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

• envoy
• Denial of service

Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

• envoy
• Memory corruption
• CWE-20

Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

• envoy
• Memory corruption

Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

• envoy
• CWE-754

Envoy: oghttp2 upstream trailers incorrect handling

• envoy
• Memory corruption
• CWE-20

Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

• envoy
• CWE-20

Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

• envoy
• HTTP request smuggling

Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

• envoy
• Memory corruption

Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

• envoy
• Memory corruption

Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

• envoy
• Memory corruption

Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

• envoy
• Memory corruption

Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

• envoy
• CWE-130

Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

• envoy
• Memory corruption

Envoy Heap Buffer Overflow in TcpStatsdSink

• envoy
• Memory corruption

Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes

• envoy
• Memory corruption

Envoy: Null pointer deref in internal redirects

• envoy
• Memory corruption

Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

• envoy
• HTTP request smuggling

Envoy: Abnormal process termination in DNS UDP filter

• envoy
• CWE-480

Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion

• envoy
• CWE-409

Envoy: Stack overflow in destructor of highly nested JSON

• envoy
• CWE-1124

Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)

• envoy
• CWE-158

Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption

• envoy
• Information disclosure
• Weak cryptography or TLS

Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification

• envoy
• Denial of service
• CWE-405

Envoy Query Parameter header_mutation.cc params.add injection

• Envoy
• Other injection
• CWE-707

Envoy Lua filter use-after-free when oversized rewritten response body causes crash

• envoy
• Memory corruption

Envoy allows large requests and responses to cause TCP connection pool crash

• envoy
• Memory corruption

Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag

• envoy
• Authentication bypass

Envoy vulnerable to bypass of RBAC uri_template permission

• envoy
• CWE-186

HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

• envoy
• CWE-670

HTTP/1: sending overload crashes when the request is reset beforehand in envoy

• envoy
• CWE-670

Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy

• envoy
• CWE-670

Potential manipulate `x-envoy` headers from external sources in envoy

• envoy
• Broken access control

oghttp2 crash on OnBeginHeadersForStream in envoy

• envoy
• CWE-670

Malicious log injection via access logs in envoy

• envoy
• Other injection

Jwt filter crash in the clear route cache with remote JWKs in envoy

• envoy
• Memory corruption

Envoy crashes for LocalReply in http async client

• envoy
• Memory corruption

Envoy Proxy use after free when route hash policy is configured with cookie attributes

• envoy
• Memory corruption

Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()

• envoy
• Memory corruption

Envoy crashes in QuicheDataReader::PeekVarInt62Length()

• envoy
• Memory corruption

Envoy can enter an endless loop while decompressing Brotli data with extra input

• envoy
• Denial of service

Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

• envoy
• Memory corruption

Envoy can crash due to uncaught nlohmann JSON exception

• envoy
• CWE-248

Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

• envoy
• Denial of service

Envoy incorrectly accepts HTTP 200 response for entering upgrade mode

• envoy
• CWE-391

Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes

• envoy
• Denial of service
• CWE-253

HTTP/2: CPU exhaustion due to CONTINUATION frame flood

• envoy
• CWE-390

HTTP/2: memory exhaustion due to CONTINUATION frame flood

• envoy
• CWE-390

Envoy crashes when idle and request per try timeout occur within the backoff interval

• envoy
• Memory corruption

Excessive CPU usage when URI template matcher is configured using regex in Envoy

• envoy
• Denial of service
• CWE-1176

Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata

• envoy
• CWE-20

Envoy crashes when using an address type that isn’t supported by the OS

• envoy
• CWE-248
• CWE-755

Crash in proxy protocol when command type of LOCAL in Envoy

• envoy
• Memory corruption

Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes

• envoy
• CWE-20

Envoy vulnerable to CORS filter segfault when origin header is removed

• envoy
• Memory corruption

Envoy's gRPC access log crash caused by the listener draining

• envoy
• Memory corruption