Envoy

This hub aggregates every CVE we track for Envoy, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Envoy.

• CVE-2026-73511Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)5.3Sep 21, 2026
• CVE-2026-73553Envoy: RBAC Authorization Bypass via Path Parameters7.5Sep 21, 2026
• CVE-2026-73551Envoy: Path normalization does not handle dot and dotdot segments with parameters5.3Sep 21, 2026
• CVE-2026-73546Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)7.4Sep 21, 2026
• CVE-2026-73512Envoy: use-after-free in QUIC on internal redirects7.5Sep 21, 2026
• CVE-2026-73550Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy7.5Sep 21, 2026
• CVE-2026-73547Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check7.5Sep 21, 2026
• CVE-2026-48521Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null5.9Sep 21, 2026
• CVE-2026-73549Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters5.3Sep 21, 2026
• CVE-2026-73513Envoy: oghttp2 upstream trailers incorrect handling7.5Sep 21, 2026
• CVE-2026-73552Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values7.5Sep 21, 2026
• CVE-2026-73548Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool7.5Sep 21, 2026
• CVE-2026-50572Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault5.9Sep 21, 2026
• CVE-2026-48090Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)5.9Jun 26, 2026
• CVE-2026-47220Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format7.5Jun 26, 2026