Known vulnerabilities in envoy

Software: envoy
Software CPE: cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Total vulnerabilities: 138
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting envoy envoy is affected by 138 known vulnerabilities: 17 high, 102 medium, 19 low Critical High Medium Low

Vulnerabilities (138)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU145873 - Use After Free
CVE-2026-50572
CWE-416 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145872 - Improper Check for Unusual or Exceptional Conditions
CVE-2026-73549
CWE-754 Low
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145871 - Use After Free
CVE-2026-73512
CWE-416 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145870 - Missing release of memory after effective lifetime
CVE-2026-73550
CWE-401 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145869 - NULL Pointer Dereference
CVE-2026-48521
CWE-476 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145868 - Use After Free
CVE-2026-73513
CWE-416 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145867 - Interpretation Conflict
CVE-2026-73553
CWE-436 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145866 - NULL Pointer Dereference
CVE-2026-73547
CWE-476 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145865 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-73548
CWE-444 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145864 - Improper input validation
CVE-2026-73552
CWE-20 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145863 - Interpretation Conflict
CVE-2026-73511
CWE-436 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145862 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-73546
CWE-79 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145861 - Use of Non-Canonical URL Paths for Authorization Decisions
CVE-2026-73551
CWE-647 Medium
No
No
1.36.10, 1.37.6, 1.38.4, 1.39.1 26.08.2026 SB2026082712
SB2026090352
#VU145845 - Off-by-one Error
CVE-2026-26309
CWE-193 Medium
No
No
1.34.13, 1.35.9, 1.36.5, 1.37.1 26.08.2026 SB2026082711
#VU145844 - Use After Free
CVE-2026-26311
CWE-416 Medium
No
No
1.34.13, 1.35.8, 1.36.5, 1.37.1 26.08.2026 SB2026082711
#VU145843 - Improper input validation
CVE-2026-26310
CWE-20 Medium
No
No
1.34.13, 1.35.9, 1.36.5, 1.37.1 26.08.2026 SB2026082711
#VU145842 - Improper input validation
CVE-2026-26308
CWE-20 Medium
No
No
1.34.13, 1.35.9, 1.36.5, 1.37.1 26.08.2026 SB2026082711
#VU145841 - Improper Handling of Exceptional Conditions
CVE-2026-26330
CWE-755 Low
No
No
1.36.5, 1.37.1 26.08.2026 SB2026082711
#VU135119 - Resource exhaustion
CWE-400 Medium
No
No
1.35.13, 1.37.0, 1.38.0 24.06.2026 SB2026062441
#VU135105 - Heap-based Buffer Overflow
CVE-2026-48706
CWE-122 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440


Showing elements 1 - 20 out of 138