Known vulnerabilities in envoy 1.25.2

Software: envoy
Version: 1.25.2
Software CPE: cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Total vulnerabilities: 53
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting envoy version 1.25.2 envoy 1.25.2 is affected by 53 vulnerabilities: 7 high, 41 medium, 5 low Critical High Medium Low

Vulnerabilities (53)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU145873 - Use After Free
CVE-2026-50572
CWE-416 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145872 - Improper Check for Unusual or Exceptional Conditions
CVE-2026-73549
CWE-754 Low
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145871 - Use After Free
CVE-2026-73512
CWE-416 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145870 - Missing release of memory after effective lifetime
CVE-2026-73550
CWE-401 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145869 - NULL Pointer Dereference
CVE-2026-48521
CWE-476 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145868 - Use After Free
CVE-2026-73513
CWE-416 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145867 - Interpretation Conflict
CVE-2026-73553
CWE-436 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145866 - NULL Pointer Dereference
CVE-2026-73547
CWE-476 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145865 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-73548
CWE-444 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145864 - Improper input validation
CVE-2026-73552
CWE-20 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145863 - Interpretation Conflict
CVE-2026-73511
CWE-436 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145862 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-73546
CWE-79 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145861 - Use of Non-Canonical URL Paths for Authorization Decisions
CVE-2026-73551
CWE-647 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU135119 - Resource exhaustion
CWE-400 Medium
No
No
1.35.13, 1.37.0, 1.38.0 24.06.2026 SB2026062441
#VU135118 - Use of Incorrect Operator
CVE-2026-48497
CWE-480 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU133363 - Asymmetric Resource Consumption (Amplification)
CVE-2026-47774
CWE-405 High
No
No
1.35.11, 1.36.7, 1.37.3, 1.38.1 04.06.2026 SB2026060494
SB20260825118
#VU105934 - Improper input validation
CVE-2025-30157
CWE-20 Medium
No
No
1.30.10, 1.31.6, 1.32.4, 1.33.1 21.03.2025 SB2025032123
#VU97626 - Improper Output Neutralization for Logs
CVE-2024-45808
CWE-117 Medium
No
No
1.28.7, 1.29.9, 1.30.6, 1.31.2 20.09.2024 SB2024092014
SB2024092023
SB2024100826
#VU97625 - Improper input validation
CVE-2024-45806
CWE-20 Medium
No
No
1.28.7, 1.29.9, 1.30.6, 1.31.2 20.09.2024 SB2024092014
SB2024092023
SB2024100825
and 1 more
#VU97623 - Resource Management Errors
CVE-2024-45810
CWE-399 Medium
No
No
1.28.7, 1.29.9, 1.30.6, 1.31.2 20.09.2024 SB2024092014
SB2024092023
SB2024100826


Showing elements 1 - 20 out of 53