Known vulnerabilities in envoy
Software:
envoy
Software CPE:
cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Website:
https://www.cncf.io/
Total vulnerabilities:
140
Public exploits:
3
Known exploited (KEV):
1
Breakdown by Severity Chart
1.40.0
1.36.13
1.37.9
1.38.7
1.39.4
1.38.6
1.37.8
1.36.12
1.39.3
1.36.11
1.37.7
1.38.5
1.39.2
1.36.10
1.37.6
1.38.4
1.39.1
1.39.0
1.38.3
1.37.5
1.36.9
1.35.13
1.38.2
1.37.4
1.36.8
1.35.12
1.38.1
1.37.3
1.36.7
1.35.11
1.38.0
1.37.2
1.36.6
1.35.10
1.34.14
1.37.1
1.36.5
1.35.9
1.34.13
1.37.0
1.36.4
1.35.8
1.34.12
1.33.14
1.36.3
1.35.7
1.34.11
1.33.13
1.36.2
1.35.6
1.34.10
1.33.12
1.34.9
1.35.5
1.36.1
1.33.11
1.36.0
1.35.4
1.34.8
1.33.10
1.32.13
1.35.3
1.34.7
1.33.9
1.32.12
1.35.2
1.34.6
1.33.8
1.32.11
1.35.1
1.34.5
1.33.7
1.32.10
1.34.4
1.33.6
1.32.9
1.35.0
1.34.3
1.33.5
1.32.8
1.31.10
1.34.2
1.33.4
1.32.7
1.31.9
1.34.1
1.33.3
1.32.6
1.31.8
1.34.0
1.33.2
1.32.5
1.31.7
1.30.11
1.33.1
1.32.4
1.31.6
1.30.10
1.33.0
1.32.3
1.31.5
1.30.9
1.29.12
1.32.2
1.31.4
1.30.8
1.29.11
1.32.1
1.31.3
1.30.7
1.29.10
1.32.0
1.31.2
1.30.6
1.29.9
1.28.7
1.31.1
1.30.5
1.29.8
1.28.6
1.31.0
1.30.4
1.29.7
1.28.5
1.27.7
1.30.3
1.29.6
1.28.4
1.29.5
1.30.2
1.27.6
1.30.1
1.29.4
1.28.3
1.27.5
1.30.0
1.29.3
1.28.2
1.27.4
1.26.8
1.29.2
1.29.1
1.28.1
1.27.3
1.26.7
1.29.0
1.28.0
1.27.2
1.26.6
1.25.11
1.24.12
1.25.10
1.26.5
1.27.1
1.24.11
1.27.0
1.25.9
1.26.4
1.24.10
1.23.12
1.26.3
1.25.8
1.24.9
1.23.11
1.26.2
1.25.7
1.24.8
1.23.10
1.26.1
1.25.6
1.24.7
1.23.9
1.26.0
1.25.5
1.24.6
1.23.8
1.22.11
1.25.4
1.24.5
1.23.7
1.22.10
1.25.3
1.24.4
1.23.6
1.22.9
1.25.2
1.24.3
1.23.5
1.22.8
1.22.7
1.23.4
1.24.2
1.25.1
1.25.0
1.24.1
1.23.3
1.22.6
1.21.6
1.24.0
1.23.2
1.23.1
1.22.5
1.22.4
1.22.3
1.21.5
1.20.7
1.23.0
1.20.6
1.20.5
1.21.4
1.22.2
1.22.1
1.21.3
1.20.4
1.19.5
1.21.2
1.20.3
1.19.4
1.22.0
1.21.1
1.20.2
1.19.3
1.18.6
1.21.0
1.20.1
1.20.0
1.16.5
1.17.4
1.18.4
1.19.1
1.19.0
1.15.5
1.16.4
1.17.3
1.18.3
1.18.2
1.14.7
1.15.4
1.16.3
1.17.2
1.18.0
1.18.1
1.17.1
1.13.8
1.17.0
1.16.2
1.13.7
1.14.6
1.15.3
1.16.1
1.16.0
1.15.2
1.13.6
1.12.7
1.13.5
1.14.5
1.15.1
1.12.6
1.13.4
1.14.4
1.15.0
1.12.5
1.13.3
1.14.3
1.12.4
1.13.2
1.14.2
1.14.1
1.14.0
1.13.1
1.13.0
1.12.3
1.12.2
1.12.1
1.12.0
1.11.2
1.11.1
1.11.0
1.10.0
1.9.1
1.9.0
1.8.0
1.7.1
1.7.0
1.6.0
1.5.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
Vulnerabilities (140)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU145873 - Use After Free CVE-2026-50572 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145872 - Improper Check for Unusual or Exceptional Conditions CVE-2026-73549 |
CWE-754 | Low | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145871 - Use After Free CVE-2026-73512 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145870 - Missing release of memory after effective lifetime CVE-2026-73550 |
CWE-401 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145869 - NULL Pointer Dereference CVE-2026-48521 |
CWE-476 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145868 - Use After Free CVE-2026-73513 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145867 - Interpretation Conflict CVE-2026-73553 |
CWE-436 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145866 - NULL Pointer Dereference CVE-2026-73547 |
CWE-476 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145865 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') CVE-2026-73548 |
CWE-444 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145864 - Improper input validation CVE-2026-73552 |
CWE-20 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145863 - Interpretation Conflict CVE-2026-73511 |
CWE-436 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145862 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-73546 |
CWE-79 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145861 - Use of Non-Canonical URL Paths for Authorization Decisions CVE-2026-73551 |
CWE-647 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145845 - Off-by-one Error CVE-2026-26309 |
CWE-193 | Medium | 1.34.13, 1.35.9, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145844 - Use After Free CVE-2026-26311 |
CWE-416 | Medium | 1.34.13, 1.35.8, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145843 - Improper input validation CVE-2026-26310 |
CWE-20 | Medium | 1.34.13, 1.35.9, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145842 - Improper input validation CVE-2026-26308 |
CWE-20 | Medium | 1.34.13, 1.35.9, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145841 - Improper Handling of Exceptional Conditions CVE-2026-26330 |
CWE-755 | Low | 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145836 - Improper Handling of Exceptional Conditions CVE-2022-23606 |
CWE-755 | Low | 1.20.2, 1.21.1 | 22.02.2022 |
SB2022022248 |
||
| #VU145837 - Improper Certificate Validation CVE-2022-21657 |
CWE-295 | Low | 1.18.6, 1.19.3, 1.20.2 | 22.02.2022 |
SB2022022248 |
Showing elements 1 - 20 out of 140