How many envoyproxy gateway CVEs are in CISA KEV?

None of envoyproxy gateway's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for envoyproxy gateway vulnerabilities?

Yes — 1 of envoyproxy gateway's CVEs have a known public exploit.

Which versions of envoyproxy gateway are affected?

55 distinct envoyproxy gateway versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in envoyproxy gateway CVEs?

envoyproxy gateway's CVEs most often map to these CWE weakness types: CWE-789 (Memory Allocation with Excessive Size Value), CWE-20 (Improper Input Validation), CWE-306 (Missing Authentication for Critical Function), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')).

How many critical envoyproxy gateway vulnerabilities are there?

envoyproxy gateway has 1 critical and 3 high-severity CVEs.

What is the average severity of envoyproxy gateway CVEs?

The average CVSS base score across envoyproxy gateway's scored CVEs is 6.9.

envoyproxy gateway Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: envoyproxy gateway vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

envoyproxy gateway has 10 published CVE records since 2025, of which none are in CISA's KEV catalog and 1 has a known public exploit. The average CVSS base score across scored CVEs is 6.9.

Severity and exploitation

How the CVSS severity of envoyproxy gateway's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High3

Medium6

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of envoyproxy gateway's CVEs are currently listed in CISA's KEV catalog.

Public exploits

One of envoyproxy gateway's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every envoyproxy gateway version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions12 most-used of 45

0.1.010 CVEs
0.2.010 CVEs
0.2.0-rc110 CVEs
0.2.0-rc210 CVEs
0.5.0-rc.110 CVEs
latest8 CVEs
< 1.7.47 CVEs
>= 1.8.0-rc.0, < 1.8.17 CVEs
1.6.0-rc.07 CVEs

Common weakness types

The CWE weakness categories most often found in envoyproxy gateway CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many envoyproxy gateway CVEs were published each year.

2025

2026

Other envoyproxy products

Browse vulnerabilities for other products by envoyproxy.

envoy128 CVEs github.com/envoyproxy/envoy11 CVEs github.com/envoyproxy/gateway10 CVEs envoy-setec1 CVE

All envoyproxy vulnerabilities

Frequently asked questions

Common questions about envoyproxy gateway vulnerabilities.

How many CVEs does envoyproxy gateway have?: envoyproxy gateway has 10 published CVE records since 2025.
How many envoyproxy gateway CVEs are in CISA KEV?: None of envoyproxy gateway's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for envoyproxy gateway vulnerabilities?: Yes — 1 of envoyproxy gateway's CVEs have a known public exploit.
Which versions of envoyproxy gateway are affected?: 55 distinct envoyproxy gateway versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in envoyproxy gateway CVEs?: envoyproxy gateway's CVEs most often map to these CWE weakness types: CWE-789 (Memory Allocation with Excessive Size Value), CWE-20 (Improper Input Validation), CWE-306 (Missing Authentication for Critical Function), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')).
How many critical envoyproxy gateway vulnerabilities are there?: envoyproxy gateway has 1 critical and 3 high-severity CVEs.
What is the average severity of envoyproxy gateway CVEs?: The average CVSS base score across envoyproxy gateway's scored CVEs is 6.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track envoyproxy gateway vulnerabilities

Get an alert for each new envoyproxy gateway CVE, with AI-written analysis and remediation steps.

Create an account See pricing

Frequently asked questions

Common questions about envoyproxy gateway vulnerabilities.

How many CVEs does envoyproxy gateway have?: envoyproxy gateway has 10 published CVE records since 2025.
How many envoyproxy gateway CVEs are in CISA KEV?: None of envoyproxy gateway's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for envoyproxy gateway vulnerabilities?: Yes — 1 of envoyproxy gateway's CVEs have a known public exploit.
Which versions of envoyproxy gateway are affected?: 55 distinct envoyproxy gateway versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in envoyproxy gateway CVEs?: envoyproxy gateway's CVEs most often map to these CWE weakness types: CWE-789 (Memory Allocation with Excessive Size Value), CWE-20 (Improper Input Validation), CWE-306 (Missing Authentication for Critical Function), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')).
How many critical envoyproxy gateway vulnerabilities are there?: envoyproxy gateway has 1 critical and 3 high-severity CVEs.
What is the average severity of envoyproxy gateway CVEs?: The average CVSS base score across envoyproxy gateway's scored CVEs is 6.9.

Affected versions and CVEs

Browse every envoyproxy gateway version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions12 most-used of 45

0.1.010 CVEs
0.2.010 CVEs
0.2.0-rc110 CVEs
0.2.0-rc210 CVEs
0.5.0-rc.110 CVEs
latest8 CVEs
< 1.7.47 CVEs
>= 1.8.0-rc.0, < 1.8.17 CVEs
1.6.0-rc.07 CVEs

Find a version

Showing the 40 most-used of 55 versions. Search to find any version.

10 CVEs

Sort

Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
CVE-2026-53714
Patch
CWE-306
High · CVSS 7.4
EPSS 0.3% (29th pct)2026-09-14
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
CVE-2026-53716
Patch
Workaround
CWE-789
Medium · CVSS 6.5
EPSS 0.7% (54th pct)2026-09-14
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
CVE-2026-53715
Patch
Workaround
CWE-362
Medium · CVSS 5.3
EPSS 0.5% (41th pct)2026-09-14
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
CVE-2026-53719
Patch
CWE-476
Medium · CVSS 6.5
EPSS 0.7% (54th pct)2026-09-14
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
CVE-2026-53718
Patch
Workaround
CWE-862
Medium · CVSS 6.4
EPSS 0.4% (36th pct)2026-09-14
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
CVE-2026-53713
Patch
CWE-20
Critical · CVSS 9.1
EPSS 0.4% (38th pct)2026-09-14
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
CVE-2026-53717
Patch
CWE-789
Medium · CVSS 6.5
EPSS 0.7% (54th pct)2026-09-14
Envoy Extension Policy lua scripts injection causes arbitrary command execution
CVE-2026-22771
Public exploit
Patch
CWE-94
High · CVSS 8.8
EPSS 0.6% (50th pct)2026-01-12
Envoy Gateway Log Injection Vulnerability
CVE-2025-25294
Patch
CWE-117
Medium · CVSS 5.3
EPSS 0.3% (21th pct)2025-03-06
Envoy Admin Interface Exposed through prometheus metrics endpoint
CVE-2025-24030
Patch
CWE-419
High · CVSS 7.1
EPSS 0.4% (36th pct)2025-01-23

envoyproxy gateway Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions12 most-used of 45

Common weakness types

Disclosure activity by year

Other envoyproxy products

Frequently asked questions

References

Track envoyproxy gateway vulnerabilities

Frequently asked questions

Affected versions and CVEs

Specific versions12 most-used of 45

Version ranges

Fixed in