---
title: "envoyproxy envoy vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/envoyproxy/envoy
type: product
description: "envoyproxy envoy has 128 published CVEs, 2 in CISA KEV and 67 with public exploits."
updated: 2026-10-22
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# envoyproxy envoy vulnerabilities

Vendor: [envoyproxy](https://radicalnotion.ai/vendor/envoyproxy)

- **Published CVEs:** 128
- **In CISA KEV:** 2
- **With a public exploit:** 67
- **With a patch:** 128
- **Average CVSS:** 7.4
- **First CVE:** 2019-04-25
- **Latest CVE:** 2026-10-22
- **Ecosystems:** bitnami

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 12 |
| High | 84 |
| Medium | 31 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 19 |
| [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 11 |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 11 |
| [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 9 |
| [CWE-670](https://radicalnotion.ai/cwe/cwe-670) | Always-Incorrect Control Flow Implementation | 5 |
| [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 4 |
| [CWE-295](https://radicalnotion.ai/cwe/cwe-295) | Improper Certificate Validation | 3 |
| [CWE-754](https://radicalnotion.ai/cwe/cwe-754) | Improper Check for Unusual or Exceptional Conditions | 3 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 8 |
| 2020 | 14 |
| 2021 | 13 |
| 2022 | 13 |
| 2023 | 12 |
| 2024 | 24 |
| 2025 | 9 |
| 2026 | 35 |

## Affected versions (top 36 of 766)

| Version | Kind | CVEs |
| --- | --- | --- |
| 1.7.0 | exact | 96 |
| 1.8.0 | exact | 96 |
| 1.9.0 | exact | 96 |
| 1.0.0 | exact | 95 |
| 1.1.0 | exact | 95 |
| 1.2.0 | exact | 95 |
| 1.3.0 | exact | 95 |
| 1.4.0 | exact | 95 |
| 1.5.0 | exact | 95 |
| 1.6.0 | exact | 95 |
| 1.10.0 | exact | 94 |
| 1.11.0 | exact | 94 |
| \< 1.36.10 | range | 13 |
| 1.37.0 \<= v \< 1.37.5 | range | 13 |
| 1.37.0 \<= v \< 1.37.6 | range | 13 |
| 1.38.0 \<= v \< 1.38.3 | range | 13 |
| 1.38.0 \<= v \< 1.38.4 | range | 13 |
| 1.39.0 \<= v \< 1.39.1 | range | 13 |
| 1.36.0 \<= v \< 1.36.9 | range | 11 |
| 1.19.0 | range | 8 |
| 1.19.0 \<= v \< 1.19.1 | range | 8 |
| 1.18.0 \<= v \< 1.18.4 | range | 7 |
| 1.20.0 \<= v \< 1.20.2 | range | 7 |
| 1.28.0 \<= v \< 1.28.4 | range | 7 |
| 1.36.10 | patched | 13 |
| 1.37.5 | patched | 13 |
| 1.37.6 | patched | 13 |
| 1.38.3 | patched | 13 |
| 1.38.4 | patched | 13 |
| 1.39.1 | patched | 13 |
| 1.36.9 | patched | 11 |
| 1.35.13 | patched | 10 |
| 1.18.4 | patched | 8 |
| 1.19.1 | patched | 8 |
| 1.20.2 | patched | 8 |
| 1.28.4 | patched | 7 |

## CVEs (first 30 of 128, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder | critical | 9.2 | Yes | Yes | Yes |
| CVE-2026-73511 | Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) | medium | 5.3 | No | Yes | Yes |
| CVE-2026-73553 | Envoy: RBAC Authorization Bypass via Path Parameters | high | 7.5 | No | Yes | Yes |
| CVE-2026-73551 | Envoy: Path normalization does not handle dot and dotdot segments with parameters | medium | 5.3 | No | No | Yes |
| CVE-2026-73546 | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) | high | 7.4 | No | Yes | Yes |
| CVE-2026-73512 | Envoy: use-after-free in QUIC on internal redirects | high | 7.5 | No | Yes | Yes |
| CVE-2026-73550 | Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy | high | 7.5 | No | Yes | Yes |
| CVE-2026-73547 | Envoy ext\_authz: request \`:path\` pseudoheader dereferenced w/o null check | high | 7.5 | No | Yes | Yes |
| CVE-2026-48521 | Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport\_socket\_options is null | medium | 5.9 | No | Yes | Yes |
| CVE-2026-73549 | Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL\_DST clusters | medium | 5.3 | No | No | Yes |
| CVE-2026-73513 | Envoy: oghttp2 upstream trailers incorrect handling | high | 7.5 | No | Yes | Yes |
| CVE-2026-73552 | Envoy: HTTP RBAC safe\_regex can fail open on RFC-valid obs-text header values | high | 7.5 | No | Yes | Yes |
| CVE-2026-73548 | Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool | high | 7.5 | No | Yes | Yes |
| CVE-2026-50572 | Envoy: ext\_authz - RawHttpClientImpl onSuccess 0x0 segfault | medium | 5.9 | No | No | Yes |
| CVE-2026-48090 | Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) | medium | 5.9 | No | Yes | Yes |
| CVE-2026-47220 | Envoy: Segmentation fault when using %REQUESTED\_SERVER\_NAME% in log format | high | 7.5 | No | Yes | Yes |
| CVE-2026-47205 | Envoy: ext\_authz Use-After-Free during Stream Teardown with Per-Route Overrides | medium | 5.9 | No | Yes | Yes |
| CVE-2026-47692 | Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream | medium | 4.8 | No | No | Yes |
| CVE-2026-47207 | Envoy crashes if multiple unexpected ext\_proc responses are packed into one gRPC message | medium | 6.5 | No | Yes | Yes |
| CVE-2026-48706 | Envoy Heap Buffer Overflow in TcpStatsdSink | high | 7.5 | No | No | Yes |
| CVE-2026-47204 | Envoy: grpc\_stats filter segfault on Connect protocol requests to direct\_response routes | high | 7.5 | No | Yes | Yes |
| CVE-2026-47221 | Envoy: Null pointer deref in internal redirects | high | 7.5 | No | Yes | Yes |
| CVE-2026-48743 | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length | high | 7.5 | No | Yes | Yes |
| CVE-2026-48497 | Envoy: Abnormal process termination in DNS UDP filter | high | 7.5 | No | No | Yes |
| CVE-2026-48044 | Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion | high | 7.5 | No | Yes | Yes |
| CVE-2026-48042 | Envoy: Stack overflow in destructor of highly nested JSON | high | 7.5 | No | Yes | Yes |
| CVE-2026-47778 | Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) | medium | 4.4 | No | Yes | Yes |
| CVE-2026-47775 | Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption | medium | 6.8 | No | Yes | Yes |
| CVE-2026-47774 | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification | high | 7.5 | No | Yes | Yes |
| CVE-2026-6994 | Envoy Query Parameter header\_mutation.cc params.add injection | high | 7.7 | No | No | Yes |

## Frequently asked questions

### How many CVEs does envoyproxy envoy have?

envoyproxy envoy has 128 published CVE records since 2019.

### How many envoyproxy envoy CVEs are in CISA KEV?

2 of envoyproxy envoy's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

### Are there public exploits for envoyproxy envoy vulnerabilities?

Yes — 67 of envoyproxy envoy's CVEs have a known public exploit.

### Which versions of envoyproxy envoy are affected?

766 distinct envoyproxy envoy versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in envoyproxy envoy CVEs?

envoyproxy envoy's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-476 (NULL Pointer Dereference), CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption).

### How many critical envoyproxy envoy vulnerabilities are there?

envoyproxy envoy has 12 critical and 84 high-severity CVEs.

### What is the average severity of envoyproxy envoy CVEs?

The average CVSS base score across envoyproxy envoy's scored CVEs is 7.4.

## Other products from this vendor

- [github.com/envoyproxy/envoy](https://radicalnotion.ai/vendor/envoyproxy/github-com-envoyproxy-envoy) (11 CVEs)
- [gateway](https://radicalnotion.ai/vendor/envoyproxy/gateway) (10 CVEs)
- [github.com/envoyproxy/gateway](https://radicalnotion.ai/vendor/envoyproxy/github-com-envoyproxy-gateway) (10 CVEs)
- [envoy-setec](https://radicalnotion.ai/vendor/envoyproxy/envoy-setec) (1 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/envoyproxy/envoy). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.