Known vulnerabilities in envoy 1.25.2
Software:
envoy
Version:
1.25.2
Software CPE:
cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Website:
https://www.cncf.io/
Total vulnerabilities:
53
Public exploits:
2
Known exploited (KEV):
1
Highest CVSSv4 Score:
9.4
Vulnerabilities by Severity
1.36.10
1.37.6
1.38.4
1.39.1
1.39.0
1.38.3
1.37.5
1.36.9
1.35.13
1.38.2
1.37.4
1.36.8
1.35.12
1.38.1
1.37.3
1.36.7
1.35.11
1.38.0
1.37.2
1.36.6
1.35.10
1.34.14
1.37.1
1.36.5
1.35.9
1.34.13
1.37.0
1.36.4
1.35.8
1.34.12
1.33.14
1.36.3
1.35.7
1.34.11
1.33.13
1.36.2
1.35.6
1.34.10
1.33.12
1.34.9
1.35.5
1.36.1
1.33.11
1.36.0
1.35.4
1.34.8
1.33.10
1.32.13
1.35.3
1.34.7
1.33.9
1.32.12
1.35.2
1.34.6
1.33.8
1.32.11
1.35.1
1.34.5
1.33.7
1.32.10
1.34.4
1.33.6
1.32.9
1.35.0
1.34.3
1.33.5
1.32.8
1.31.10
1.34.2
1.33.4
1.32.7
1.31.9
1.34.1
1.33.3
1.32.6
1.31.8
1.34.0
1.33.2
1.32.5
1.31.7
1.30.11
1.33.1
1.32.4
1.31.6
1.30.10
1.33.0
1.32.3
1.31.5
1.30.9
1.29.12
1.32.2
1.31.4
1.30.8
1.29.11
1.32.1
1.31.3
1.30.7
1.29.10
1.32.0
1.31.2
1.30.6
1.29.9
1.28.7
1.31.1
1.30.5
1.29.8
1.28.6
1.31.0
1.30.4
1.29.7
1.28.5
1.27.7
1.30.3
1.29.6
1.28.4
1.29.5
1.30.2
1.27.6
1.30.1
1.29.4
1.28.3
1.27.5
1.30.0
1.29.3
1.28.2
1.27.4
1.26.8
1.29.2
1.29.1
1.28.1
1.27.3
1.26.7
1.29.0
1.28.0
1.27.2
1.26.6
1.25.11
1.24.12
1.25.10
1.26.5
1.27.1
1.24.11
1.27.0
1.25.9
1.26.4
1.24.10
1.23.12
1.26.3
1.25.8
1.24.9
1.23.11
1.26.2
1.25.7
1.24.8
1.23.10
1.26.1
1.25.6
1.24.7
1.23.9
1.26.0
1.25.5
1.24.6
1.23.8
1.22.11
1.25.4
1.24.5
1.23.7
1.22.10
1.25.3
1.24.4
1.23.6
1.22.9
1.25.2
1.24.3
1.23.5
1.22.8
1.22.7
1.23.4
1.24.2
1.25.1
1.25.0
1.24.1
1.23.3
1.22.6
1.21.6
1.24.0
1.23.2
1.23.1
1.22.5
1.22.4
1.22.3
1.21.5
1.20.7
1.23.0
1.20.6
1.20.5
1.21.4
1.22.2
1.22.1
1.21.3
1.20.4
1.19.5
1.21.2
1.20.3
1.19.4
1.22.0
1.21.1
1.20.2
1.19.3
1.18.6
1.21.0
1.20.1
1.20.0
1.16.5
1.17.4
1.18.4
1.19.1
1.19.0
1.15.5
1.16.4
1.17.3
1.18.3
1.18.2
1.14.7
1.15.4
1.16.3
1.17.2
1.18.0
1.18.1
1.17.1
1.13.8
1.17.0
1.16.2
1.13.7
1.14.6
1.15.3
1.16.1
1.16.0
1.15.2
1.13.6
1.12.7
1.13.5
1.14.5
1.15.1
1.12.6
1.13.4
1.14.4
1.15.0
1.12.5
1.13.3
1.14.3
1.12.4
1.13.2
1.14.2
1.14.1
1.14.0
1.13.1
1.13.0
1.12.3
1.12.2
1.12.1
1.12.0
1.11.2
1.11.1
1.11.0
1.10.0
1.9.1
1.9.0
1.8.0
1.7.1
1.7.0
1.6.0
1.5.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
Vulnerabilities (53)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU145873 - Use After Free CVE-2026-50572 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145872 - Improper Check for Unusual or Exceptional Conditions CVE-2026-73549 |
CWE-754 | Low | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145871 - Use After Free CVE-2026-73512 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145870 - Missing release of memory after effective lifetime CVE-2026-73550 |
CWE-401 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145869 - NULL Pointer Dereference CVE-2026-48521 |
CWE-476 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145868 - Use After Free CVE-2026-73513 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145867 - Interpretation Conflict CVE-2026-73553 |
CWE-436 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145866 - NULL Pointer Dereference CVE-2026-73547 |
CWE-476 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145865 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') CVE-2026-73548 |
CWE-444 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145864 - Improper input validation CVE-2026-73552 |
CWE-20 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145863 - Interpretation Conflict CVE-2026-73511 |
CWE-436 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145862 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-73546 |
CWE-79 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145861 - Use of Non-Canonical URL Paths for Authorization Decisions CVE-2026-73551 |
CWE-647 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU135119 - Resource exhaustion |
CWE-400 | Medium | 1.35.13, 1.37.0, 1.38.0 | 24.06.2026 |
SB2026062441 |
||
| #VU135118 - Use of Incorrect Operator CVE-2026-48497 |
CWE-480 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU133363 - Asymmetric Resource Consumption (Amplification) CVE-2026-47774 |
CWE-405 | High | 1.35.11, 1.36.7, 1.37.3, 1.38.1 | 04.06.2026 |
SB2026060494 SB20260825118 |
||
| #VU105934 - Improper input validation CVE-2025-30157 |
CWE-20 | Medium | 1.30.10, 1.31.6, 1.32.4, 1.33.1 | 21.03.2025 |
SB2025032123 |
||
| #VU97626 - Improper Output Neutralization for Logs CVE-2024-45808 |
CWE-117 | Medium | 1.28.7, 1.29.9, 1.30.6, 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 SB2024100826 |
||
| #VU97625 - Improper input validation CVE-2024-45806 |
CWE-20 | Medium | 1.28.7, 1.29.9, 1.30.6, 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 SB2024100825 and 1 more |
||
| #VU97623 - Resource Management Errors CVE-2024-45810 |
CWE-399 | Medium | 1.28.7, 1.29.9, 1.30.6, 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 SB2024100826 |
Showing elements 1 - 20 out of 53