Envoy vulnerabilities

60 known vulnerabilities in Envoy from Envoyproxy. 60 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  envoy: Detection of Error Condition Without Action

  CVE-2024-27919Apr 4, 2024EnvoyproxyEPSS 83.9%

  Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceede

• 7.5 High severity

  envoy: NULL Pointer Dereference

  CVE-2024-23327Feb 9, 2024Envoyproxy

  Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command typ

• 7.5 High severity

  envoy: Improper Handling of Exceptional Conditions

  CVE-2024-23325Feb 9, 2024Envoyproxy

  Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled wh

• 7.5 High severity

  Envoy is a high-performance edge/middle/service proxy.

  CVE-2024-23324Feb 9, 2024Envoyproxy

  Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set

• 7.5 High severity

  envoy: Use After Free

  CVE-2024-23322Feb 9, 2024Envoyproxy

  Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only

• 7.5 High severity

  HTTP/2 Rapid Reset Attack Exploited

  CVE-2023-44487Oct 10, 2023IETFEPSS 100%

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

• 7.5 High severity

  envoy: Use After Free

  CVE-2023-35943Jul 25, 2023Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decode

• 9.8 Critical severity

  envoy: Improper Encoding or Escaping of Output

  CVE-2023-35941Jul 25, 2023Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This

• 7.5 High severity

  envoy: Incomplete Cleanup

  CVE-2023-35945Jul 13, 2023EnvoyproxyEPSS 1.65%

  Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pe

• 7.5 High severity

  Envoy is an open source edge and service proxy designed for cloud-native applications.

  CVE-2023-27496Apr 4, 2023Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redirec

• 9.1 Critical severity

  envoy: Inconsistent Interpretation of HTTP Requests

  CVE-2023-27493Apr 4, 2023Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characte

• 9.1 Critical severity

  envoy: Inconsistent Interpretation of HTTP Requests

  CVE-2023-27491Apr 4, 2023Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/

• 9.8 Critical severity

  Envoy is an open source edge and service proxy designed for cloud-native applications.

  CVE-2023-27488Apr 4, 2023Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For

• 9.1 Critical severity

  Envoy is an open source edge and service proxy designed for cloud-native applications.

  CVE-2023-27487Apr 4, 2023Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-p

• 7.5 High severity

  envoy: Use After Free

  CVE-2022-29228Jun 9, 2022EnvoyproxyEPSS 1.28%

  Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier ver

• 7.5 High severity

  envoy: Use After Free

  CVE-2022-29227Jun 9, 2022EnvoyproxyEPSS 1.25%

  Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while repl

• 9.1 Critical severity

  envoy: Missing Authentication for Critical Functionality

  CVE-2022-29226Jun 9, 2022EnvoyproxyEPSS 1.35%

  Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be trig

• 7.5 High severity

  envoy: Uncontrolled Resource Consumption

  CVE-2022-29225Jun 9, 2022EnvoyproxyEPSS 1.61%

  Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by

• 7.5 High severity

  envoy: Always-Incorrect Control Flow Implementation

  CVE-2022-21655Feb 22, 2022EnvoyproxyEPSS 1.15%

  Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service.

• 9.8 Critical severity

  envoy: Improper Certificate Validation

  CVE-2022-21654Feb 22, 2022EnvoyproxyEPSS 1.09%

  Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls