Envoy Proxy Envoy

Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion

Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

Envoy allows large requests and responses to cause TCP connection pool crash

Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes

Envoy: Null pointer deref in internal redirects

Crash for scoped ip address in Envoy during DNS

Envoy crashes when HTTP ext_proc processes local replies

Envoy Lua filter use-after-free when oversized rewritten response body causes crash

Envoy: Abnormal process termination in DNS UDP filter

Jwt filter crash in the clear route cache with remote JWKs in envoy

Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly

Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

X.509 subjectAltName matching bypass in Envoy

Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

X.509 Extended Key Usage and Trust Purposes bypass in Envoy

Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption

Crash when a cluster is deleted in Envoy

Envoy's gRPC access log crash caused by the listener draining

Envoy may crash when a large request body is processed in Lua filter

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

Potential manipulate `x-envoy` headers from external sources in envoy

Malicious log injection via access logs in envoy

Segmentation fault leading to crash in Envoy

Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null

Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

Envoy HTTP: filter chain execution on reset streams causing UAF crash

Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

TLS Validation Vulnerability in Envoy

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.

Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.

Envoy: Path normalization does not handle dot and dotdot segments with parameters

Excessive CPU usage when URI template matcher is configured using regex in Envoy