Known vulnerabilities in envoy
Software:
envoy
Software CPE:
cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Website:
https://www.cncf.io/
Total vulnerabilities:
138
Public exploits:
3
Known exploited (KEV):
1
Highest CVSSv4 Score:
9.4
Breakdown by Severity Chart
1.36.10
1.37.6
1.38.4
1.39.1
1.39.0
1.38.3
1.37.5
1.36.9
1.35.13
1.38.2
1.37.4
1.36.8
1.35.12
1.38.1
1.37.3
1.36.7
1.35.11
1.38.0
1.37.2
1.36.6
1.35.10
1.34.14
1.37.1
1.36.5
1.35.9
1.34.13
1.37.0
1.36.4
1.35.8
1.34.12
1.33.14
1.36.3
1.35.7
1.34.11
1.33.13
1.36.2
1.35.6
1.34.10
1.33.12
1.34.9
1.35.5
1.36.1
1.33.11
1.36.0
1.35.4
1.34.8
1.33.10
1.32.13
1.35.3
1.34.7
1.33.9
1.32.12
1.35.2
1.34.6
1.33.8
1.32.11
1.35.1
1.34.5
1.33.7
1.32.10
1.34.4
1.33.6
1.32.9
1.35.0
1.34.3
1.33.5
1.32.8
1.31.10
1.34.2
1.33.4
1.32.7
1.31.9
1.34.1
1.33.3
1.32.6
1.31.8
1.34.0
1.33.2
1.32.5
1.31.7
1.30.11
1.33.1
1.32.4
1.31.6
1.30.10
1.33.0
1.32.3
1.31.5
1.30.9
1.29.12
1.32.2
1.31.4
1.30.8
1.29.11
1.32.1
1.31.3
1.30.7
1.29.10
1.32.0
1.31.2
1.30.6
1.29.9
1.28.7
1.31.1
1.30.5
1.29.8
1.28.6
1.31.0
1.30.4
1.29.7
1.28.5
1.27.7
1.30.3
1.29.6
1.28.4
1.29.5
1.30.2
1.27.6
1.30.1
1.29.4
1.28.3
1.27.5
1.30.0
1.29.3
1.28.2
1.27.4
1.26.8
1.29.2
1.29.1
1.28.1
1.27.3
1.26.7
1.29.0
1.28.0
1.27.2
1.26.6
1.25.11
1.24.12
1.25.10
1.26.5
1.27.1
1.24.11
1.27.0
1.25.9
1.26.4
1.24.10
1.23.12
1.26.3
1.25.8
1.24.9
1.23.11
1.26.2
1.25.7
1.24.8
1.23.10
1.26.1
1.25.6
1.24.7
1.23.9
1.26.0
1.25.5
1.24.6
1.23.8
1.22.11
1.25.4
1.24.5
1.23.7
1.22.10
1.25.3
1.24.4
1.23.6
1.22.9
1.25.2
1.24.3
1.23.5
1.22.8
1.22.7
1.23.4
1.24.2
1.25.1
1.25.0
1.24.1
1.23.3
1.22.6
1.21.6
1.24.0
1.23.2
1.23.1
1.22.5
1.22.4
1.22.3
1.21.5
1.20.7
1.23.0
1.20.6
1.20.5
1.21.4
1.22.2
1.22.1
1.21.3
1.20.4
1.19.5
1.21.2
1.20.3
1.19.4
1.22.0
1.21.1
1.20.2
1.19.3
1.18.6
1.21.0
1.20.1
1.20.0
1.16.5
1.17.4
1.18.4
1.19.1
1.19.0
1.15.5
1.16.4
1.17.3
1.18.3
1.18.2
1.14.7
1.15.4
1.16.3
1.17.2
1.18.0
1.18.1
1.17.1
1.13.8
1.17.0
1.16.2
1.13.7
1.14.6
1.15.3
1.16.1
1.16.0
1.15.2
1.13.6
1.12.7
1.13.5
1.14.5
1.15.1
1.12.6
1.13.4
1.14.4
1.15.0
1.12.5
1.13.3
1.14.3
1.12.4
1.13.2
1.14.2
1.14.1
1.14.0
1.13.1
1.13.0
1.12.3
1.12.2
1.12.1
1.12.0
1.11.2
1.11.1
1.11.0
1.10.0
1.9.1
1.9.0
1.8.0
1.7.1
1.7.0
1.6.0
1.5.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
Vulnerabilities (138)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU145873 - Use After Free CVE-2026-50572 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145872 - Improper Check for Unusual or Exceptional Conditions CVE-2026-73549 |
CWE-754 | Low | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145871 - Use After Free CVE-2026-73512 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145870 - Missing release of memory after effective lifetime CVE-2026-73550 |
CWE-401 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145869 - NULL Pointer Dereference CVE-2026-48521 |
CWE-476 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145868 - Use After Free CVE-2026-73513 |
CWE-416 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145867 - Interpretation Conflict CVE-2026-73553 |
CWE-436 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145866 - NULL Pointer Dereference CVE-2026-73547 |
CWE-476 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145865 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') CVE-2026-73548 |
CWE-444 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145864 - Improper input validation CVE-2026-73552 |
CWE-20 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145863 - Interpretation Conflict CVE-2026-73511 |
CWE-436 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145862 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-73546 |
CWE-79 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145861 - Use of Non-Canonical URL Paths for Authorization Decisions CVE-2026-73551 |
CWE-647 | Medium | 1.36.10, 1.37.6, 1.38.4, 1.39.1 | 26.08.2026 |
SB2026082712 SB2026090352 |
||
| #VU145845 - Off-by-one Error CVE-2026-26309 |
CWE-193 | Medium | 1.34.13, 1.35.9, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145844 - Use After Free CVE-2026-26311 |
CWE-416 | Medium | 1.34.13, 1.35.8, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145843 - Improper input validation CVE-2026-26310 |
CWE-20 | Medium | 1.34.13, 1.35.9, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145842 - Improper input validation CVE-2026-26308 |
CWE-20 | Medium | 1.34.13, 1.35.9, 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU145841 - Improper Handling of Exceptional Conditions CVE-2026-26330 |
CWE-755 | Low | 1.36.5, 1.37.1 | 26.08.2026 |
SB2026082711 |
||
| #VU135119 - Resource exhaustion |
CWE-400 | Medium | 1.35.13, 1.37.0, 1.38.0 | 24.06.2026 |
SB2026062441 |
||
| #VU135105 - Heap-based Buffer Overflow CVE-2026-48706 |
CWE-122 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
Showing elements 1 - 20 out of 138