envoyproxy vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 202210
3. 202210
4. 202311
5. 202424
6. 202511
7. 202641

Newest CVEs

• CVE-2026-73511

  Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

  envoyproxy · envoy

  Medium5.3
• CVE-2026-73553

  Envoy: RBAC Authorization Bypass via Path Parameters

  envoyproxy · envoy

  High7.5
• CVE-2026-73551

  Envoy: Path normalization does not handle dot and dotdot segments with parameters

  envoyproxy · envoy

  Medium5.3
• CVE-2026-73546

  Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

  envoyproxy · envoy

  High7.4
• CVE-2026-73512

  Envoy: use-after-free in QUIC on internal redirects

  envoyproxy · envoy

  High7.5
• CVE-2026-73550

  Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

  envoyproxy · envoy

  High7.5
• CVE-2026-73547

  Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

  envoyproxy · envoy

  High7.5
• CVE-2026-48521

  Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

  envoyproxy · envoy

  Medium5.9
• CVE-2026-73549

  Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

  envoyproxy · envoy

  Medium5.3
• CVE-2026-73513

  Envoy: oghttp2 upstream trailers incorrect handling

  envoyproxy · envoy

  High7.5