Known vulnerabilities in envoy - page 2

Software: envoy
Software CPE: cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Total vulnerabilities: 138
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting envoy envoy is affected by 138 known vulnerabilities: 17 high, 102 medium, 19 low Critical High Medium Low

Vulnerabilities (138)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135118 - Use of Incorrect Operator
CVE-2026-48497
CWE-480 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135117 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2026-47775
CWE-327 Medium
No
No
1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135116 - Use After Free
CVE-2026-47207
CWE-416 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135115 - NULL Pointer Dereference
CVE-2026-47221
CWE-476 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135114 - Improper input validation
CVE-2026-47220
CWE-20 Medium
No
No
1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135113 - Improper input validation
CVE-2026-47692
CWE-20 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135112 - Resource exhaustion
CVE-2026-48044
CWE-400 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135111 - Stack-based buffer overflow
CVE-2026-48042
CWE-121 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135110 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-48743
CWE-444 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135109 - NULL Pointer Dereference
CVE-2026-47204
CWE-476 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135108 - Use After Free
CVE-2026-47205
CWE-416 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135107 - Use After Free
CVE-2026-48090
CWE-416 Medium
No
No
1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135106 - Improper input validation
CVE-2026-47778
CWE-20 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU133363 - Asymmetric Resource Consumption (Amplification)
CVE-2026-47774
CWE-405 High
No
No
1.35.11, 1.36.7, 1.37.3, 1.38.1 04.06.2026 SB2026060494
SB20260825118
#VU119718 - Use After Free
CWE-416 Medium
No
No
1.33.13, 1.34.11, 1.35.7, 1.36.3 10.12.2025 SB2025121089
#VU119112 - Improper Certificate Validation
CVE-2025-66220
CWE-295 Low
No
No
1.33.13, 1.34.11, 1.35.7, 1.36.3 03.12.2025 SB2025120345
#VU119111 - State Issues
CVE-2025-64763
CWE-371 Low
No
No
1.33.13, 1.34.11, 1.35.7, 1.36.3 03.12.2025 SB2025120345
#VU119110 - Improper input validation
CVE-2025-64527
CWE-20 Medium
No
No
1.33.13, 1.34.11, 1.35.7, 1.36.3 03.12.2025 SB2025120345
#VU119109 - Incorrect Regular Expression
CVE-2025-46821
CWE-185 Medium
No
No
1.31.8, 1.32.6, 1.33.3, 1.34.1 03.12.2025 SB2025120344
#VU103646 - Integer overflow
CVE-2025-0725
CWE-190 High
No
No
1.33.10, 1.34.8, 1.35.4 05.02.2025 SB2025020531
SB2025020601
SB2025020658
and 25 more


Showing elements 21 - 40 out of 138