Envoy Proxy Envoyproxy Envoy

Jwt filter crash in the clear route cache with remote JWKs in envoy

Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly

Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

X.509 subjectAltName matching bypass in Envoy

HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

X.509 Extended Key Usage and Trust Purposes bypass in Envoy

Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption

Crash when a cluster is deleted in Envoy

Envoy's gRPC access log crash caused by the listener draining

Envoy may crash when a large request body is processed in Lua filter

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

Potential manipulate `x-envoy` headers from external sources in envoy

Malicious log injection via access logs in envoy

Segmentation fault leading to crash in Envoy

Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

Envoy HTTP: filter chain execution on reset streams causing UAF crash

Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

TLS Validation Vulnerability in Envoy

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.

Excessive CPU usage when URI template matcher is configured using regex in Envoy

Envoy has an off-by-one write in JsonEscaper::escapeString()

Envoy forwards early CONNECT data in TCP proxy mode

Envoy vulnerable to bypass of RBAC uri_template permission

Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request for a domain concurrently configured explicitly (e.g., abc.example.com) is sent to the server(s) listening behind *.example.com. The outcome should instead be 421 Misdirected Request. Imagine a shared caching forward proxy re-using an HTTP/2 connection for a large subnet with many users. If a victim is interacting with abc.example.com, and a server (for abc.example.com) recycles the TCP connection to the forward proxy, the victim's browser may suddenly start sending sensitive data to a *.example.com server. This occurs because the forward proxy between the victim and the origin server reuses connections (which obeys the specification), but neither Istio nor Envoy corrects this by sending a 421 error. Similarly, this behavior voids the security model browsers have put in place between domains.