How many CVEs have a located fix in envoyproxy/envoy?

44 published CVEs have a fix traced to functions in envoyproxy/envoy, touching 205 functions across 123 files.

Which function in envoyproxy/envoy has been patched by the most CVEs?

MessageDone in source/common/http/http1/balsa_parser.cc has been changed by 3 CVE fixes, from 2024 to 2024.

How large is a typical CVE fix in envoyproxy/envoy?

The median fix changes 48 lines. 25% of fixes change 20 lines or fewer, and 18% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

cpp

c

#88 of 500 repositories

envoyproxy/envoy

Name: envoyproxy/envoy: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 21, 2026

44

CVE fixes located

Published CVEs

205

Functions patched

Distinct function sites

123

Files patched

Distinct source files

2019–2026

Years covered

By CVE publication date

Overview

44 published CVEs have a fix traced to functions in envoyproxy/envoy, the earliest published in 2019. Those fixes changed 205 distinct functions across 123 files, in 1,572 patch hunks.

Among the 500 repositories tracked here, envoyproxy/envoy ranks #88 by the number of CVEs with a located fix.

Most patched functions

Functions in envoyproxy/envoy changed by the most CVE fixes.

Most patched files

Files in envoyproxy/envoy changed by the most CVE fixes.

1source/common/runtime/runtime_features.cc16 CVEs · 0 functions
2source/common/http/conn_manager_impl.cc4 CVEs · 14 functions
3source/common/http/http1/codec_impl.cc4 CVEs · 4 functions
4source/common/router/config_impl.h3 CVEs · 10 functions
5source/common/router/router.cc3 CVEs · 3 functions
6source/extensions/filters/listener/proxy_protocol/proxy_protocol.cc3 CVEs · 3 functions
7source/common/http/http1/balsa_parser.cc3 CVEs · 1 functions
8source/common/http/http1/balsa_parser.h3 CVEs · 1 functions
9source/common/router/config_impl.cc2 CVEs · 9 functions
10source/common/http/http2/codec_impl.cc2 CVEs · 6 functions

Fix size

How much code a CVE fix in envoyproxy/envoy changes, with backports counted once.

48

Median lines changed

Added plus removed, per CVE

25%

Fixes of 20 lines or fewer

Share of CVE fixes

18%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in envoyproxy/envoy, and the functions each fix changed.

Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
CVE-2026-73511removePathParameters matches evaluateRuntimeMatch
Medium · CVSS 5.3
EPSS 0.4%2026-09-21
Envoy: RBAC Authorization Bypass via Path Parameters
CVE-2026-73553route CommonConfig ignorePathParametersInPathMatching
High · CVSS 7.5
EPSS 0.5%2026-09-21
Envoy: Path normalization does not handle dot and dotdot segments with parameters
CVE-2026-73551stripParametersFromDotSegments canonicalPath PathUtil
Medium · CVSS 5.3
EPSS 0.5%2026-09-21
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
CVE-2026-73546generate requiresSanitization runtimeFeatureEnabled
High · CVSS 7.4
EPSS 0.6%2026-09-21
Envoy: use-after-free in QUIC on internal redirects
CVE-2026-73512useCapsuleProtocol decodeCapsule setStreamDecoderProvider
High · CVSS 7.5
EPSS 0.9%2026-09-21
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
CVE-2026-73550checkHeaderLimits onHeader recordHistogramsForStream
High · CVSS 7.5
EPSS 0.6%2026-09-21
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
CVE-2026-73547queryParameterIsUrlEncoded modifyQueryParameters
High · CVSS 7.5
EPSS 0.6%2026-09-21
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
CVE-2026-48521allocateConnPool
Medium · CVSS 5.9
EPSS 0.7%2026-09-21
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
CVE-2026-73549probeWithNewPort ClientConnectionImpl host_ip_port
Medium · CVSS 5.3
EPSS 0.6%2026-09-21
Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
CVE-2026-73552initRe2Options regex_
High · CVSS 7.5
EPSS 0.5%2026-09-21
Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
CVE-2026-73548is2xx isUpgrade pausedForGenericUpgrade
High · CVSS 7.5
EPSS 0.5%2026-09-21
Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
CVE-2026-50572onFailure onSuccess check
Medium · CVSS 5.9
EPSS 0.7%2026-09-21

Get an alert for each new envoyproxy/envoy CVE, with the patched functions and AI-written analysis.

Monitor envoy CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

android.googlesource.com/platform-packages-apps-Settings44 CVEs Dokploy/dokploy44 CVEs frappe/frappe44 CVEs nltk/nltk44 CVEs argoproj/argo-cd43 CVEs coollabsio/coolify43 CVEs grafana/grafana43 CVEs LimeSurvey/LimeSurvey43 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in envoyproxy/envoy.

How many CVEs have a located fix in envoyproxy/envoy?: 44 published CVEs have a fix traced to functions in envoyproxy/envoy, touching 205 functions across 123 files.
Which function in envoyproxy/envoy has been patched by the most CVEs?: MessageDone in source/common/http/http1/balsa_parser.cc has been changed by 3 CVE fixes, from 2024 to 2024.
How large is a typical CVE fix in envoyproxy/envoy?: The median fix changes 48 lines. 25% of fixes change 20 lines or fewer, and 18% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track envoyproxy/envoy CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing