--- title: "envoyproxy vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/envoyproxy type: vendor description: "envoyproxy has 138 published CVEs, 2 in CISA KEV and 68 with public exploits." updated: 2026-10-22 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # envoyproxy vulnerabilities - **Published CVEs:** 138 - **In CISA KEV:** 2 - **With a public exploit:** 68 - **With a patch:** 138 - **Average CVSS:** 7.3 - **CVEs in the last two years:** 54 - **First CVE:** 2019-04-25 - **Latest CVE:** 2026-10-22 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 13 | | High | 87 | | Medium | 37 | | Low | 1 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [envoy](https://radicalnotion.ai/vendor/envoyproxy/envoy) | 128 | | [github.com/envoyproxy/envoy](https://radicalnotion.ai/vendor/envoyproxy/github-com-envoyproxy-envoy) | 11 | | [gateway](https://radicalnotion.ai/vendor/envoyproxy/gateway) | 10 | | [github.com/envoyproxy/gateway](https://radicalnotion.ai/vendor/envoyproxy/github-com-envoyproxy-gateway) | 10 | | [envoy-setec](https://radicalnotion.ai/vendor/envoyproxy/envoy-setec) | 1 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 19 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 12 | | [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 12 | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 9 | | [CWE-670](https://radicalnotion.ai/cwe/cwe-670) | Always-Incorrect Control Flow Implementation | 5 | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 4 | | [CWE-295](https://radicalnotion.ai/cwe/cwe-295) | Improper Certificate Validation | 3 | | [CWE-754](https://radicalnotion.ai/cwe/cwe-754) | Improper Check for Unusual or Exceptional Conditions | 3 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [GitHub\_M](https://radicalnotion.ai/cna/github-m) | 111 | | [mitre](https://radicalnotion.ai/cna/mitre) | 25 | | [VulDB](https://radicalnotion.ai/cna/vuldb) | 1 | | [Google](https://radicalnotion.ai/cna/google) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2019 | 8 | | 2020 | 14 | | 2021 | 13 | | 2022 | 13 | | 2023 | 12 | | 2024 | 24 | | 2025 | 11 | | 2026 | 43 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder | critical | 9.2 | 82.6% | Yes | 2026-10-22 | | CVE-2026-73511 | Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) | medium | 5.3 | 0.4% | No | 2026-09-21 | | CVE-2026-73553 | Envoy: RBAC Authorization Bypass via Path Parameters | high | 7.5 | 0.5% | No | 2026-09-21 | | CVE-2026-73551 | Envoy: Path normalization does not handle dot and dotdot segments with parameters | medium | 5.3 | 0.5% | No | 2026-09-21 | | CVE-2026-73546 | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) | high | 7.4 | 0.6% | No | 2026-09-21 | | CVE-2026-73512 | Envoy: use-after-free in QUIC on internal redirects | high | 7.5 | 0.9% | No | 2026-09-21 | | CVE-2026-73550 | Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy | high | 7.5 | 0.6% | No | 2026-09-21 | | CVE-2026-73547 | Envoy ext\_authz: request \`:path\` pseudoheader dereferenced w/o null check | high | 7.5 | 0.6% | No | 2026-09-21 | | CVE-2026-48521 | Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport\_socket\_options is null | medium | 5.9 | 0.7% | No | 2026-09-21 | | CVE-2026-73549 | Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL\_DST clusters | medium | 5.3 | 0.6% | No | 2026-09-21 | | CVE-2026-73513 | Envoy: oghttp2 upstream trailers incorrect handling | high | 7.5 | 0.5% | No | 2026-09-21 | | CVE-2026-73552 | Envoy: HTTP RBAC safe\_regex can fail open on RFC-valid obs-text header values | high | 7.5 | 0.5% | No | 2026-09-21 | ## Frequently asked questions ### How many CVEs does envoyproxy have? envoyproxy has 138 published CVE records since 2019, including 54 in the last two years. ### How many envoyproxy CVEs are in CISA KEV? 2 of envoyproxy's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Which envoyproxy products have the most CVEs? The envoyproxy products with the most published CVEs are envoy, github.com/envoyproxy/envoy, gateway, github.com/envoyproxy/gateway, envoy-setec. ### What are the most common weakness types in envoyproxy CVEs? envoyproxy's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-20 (Improper Input Validation), CWE-476 (NULL Pointer Dereference), CWE-400 (Uncontrolled Resource Consumption). ### Are there public exploits for envoyproxy vulnerabilities? Yes — 68 of envoyproxy's CVEs have a known public exploit. ### How many critical envoyproxy vulnerabilities are there? envoyproxy has 13 critical and 87 high-severity CVEs. ### What is the average severity of envoyproxy CVEs? The average CVSS base score across envoyproxy's scored CVEs is 7.3. ## Related vendors - [Kubernetes](https://radicalnotion.ai/vendor/kubernetes) (140 CVEs) - [ruby-lang](https://radicalnotion.ai/vendor/rubylang) (140 CVEs) - [AncoraThemes](https://radicalnotion.ai/vendor/ancorathemes) (140 CVEs) - [Asterisk](https://radicalnotion.ai/vendor/asterisk) (139 CVEs) - [NLnet Labs](https://radicalnotion.ai/vendor/nlnet-labs) (139 CVEs) - [VideoLAN](https://radicalnotion.ai/vendor/videolan) (139 CVEs) - [Centreon](https://radicalnotion.ai/vendor/centreon) (137 CVEs) - [Snipeitapp](https://radicalnotion.ai/vendor/snipeitapp) (137 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/envoyproxy). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.