Known vulnerabilities in envoy - page 3
Software:
envoy
Software CPE:
cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Website:
https://www.cncf.io/
Total vulnerabilities:
140
Public exploits:
3
Known exploited (KEV):
1
Breakdown by Severity Chart
1.40.0
1.36.13
1.37.9
1.38.7
1.39.4
1.38.6
1.37.8
1.36.12
1.39.3
1.36.11
1.37.7
1.38.5
1.39.2
1.36.10
1.37.6
1.38.4
1.39.1
1.39.0
1.38.3
1.37.5
1.36.9
1.35.13
1.38.2
1.37.4
1.36.8
1.35.12
1.38.1
1.37.3
1.36.7
1.35.11
1.38.0
1.37.2
1.36.6
1.35.10
1.34.14
1.37.1
1.36.5
1.35.9
1.34.13
1.37.0
1.36.4
1.35.8
1.34.12
1.33.14
1.36.3
1.35.7
1.34.11
1.33.13
1.36.2
1.35.6
1.34.10
1.33.12
1.34.9
1.35.5
1.36.1
1.33.11
1.36.0
1.35.4
1.34.8
1.33.10
1.32.13
1.35.3
1.34.7
1.33.9
1.32.12
1.35.2
1.34.6
1.33.8
1.32.11
1.35.1
1.34.5
1.33.7
1.32.10
1.34.4
1.33.6
1.32.9
1.35.0
1.34.3
1.33.5
1.32.8
1.31.10
1.34.2
1.33.4
1.32.7
1.31.9
1.34.1
1.33.3
1.32.6
1.31.8
1.34.0
1.33.2
1.32.5
1.31.7
1.30.11
1.33.1
1.32.4
1.31.6
1.30.10
1.33.0
1.32.3
1.31.5
1.30.9
1.29.12
1.32.2
1.31.4
1.30.8
1.29.11
1.32.1
1.31.3
1.30.7
1.29.10
1.32.0
1.31.2
1.30.6
1.29.9
1.28.7
1.31.1
1.30.5
1.29.8
1.28.6
1.31.0
1.30.4
1.29.7
1.28.5
1.27.7
1.30.3
1.29.6
1.28.4
1.29.5
1.30.2
1.27.6
1.30.1
1.29.4
1.28.3
1.27.5
1.30.0
1.29.3
1.28.2
1.27.4
1.26.8
1.29.2
1.29.1
1.28.1
1.27.3
1.26.7
1.29.0
1.28.0
1.27.2
1.26.6
1.25.11
1.24.12
1.25.10
1.26.5
1.27.1
1.24.11
1.27.0
1.25.9
1.26.4
1.24.10
1.23.12
1.26.3
1.25.8
1.24.9
1.23.11
1.26.2
1.25.7
1.24.8
1.23.10
1.26.1
1.25.6
1.24.7
1.23.9
1.26.0
1.25.5
1.24.6
1.23.8
1.22.11
1.25.4
1.24.5
1.23.7
1.22.10
1.25.3
1.24.4
1.23.6
1.22.9
1.25.2
1.24.3
1.23.5
1.22.8
1.22.7
1.23.4
1.24.2
1.25.1
1.25.0
1.24.1
1.23.3
1.22.6
1.21.6
1.24.0
1.23.2
1.23.1
1.22.5
1.22.4
1.22.3
1.21.5
1.20.7
1.23.0
1.20.6
1.20.5
1.21.4
1.22.2
1.22.1
1.21.3
1.20.4
1.19.5
1.21.2
1.20.3
1.19.4
1.22.0
1.21.1
1.20.2
1.19.3
1.18.6
1.21.0
1.20.1
1.20.0
1.16.5
1.17.4
1.18.4
1.19.1
1.19.0
1.15.5
1.16.4
1.17.3
1.18.3
1.18.2
1.14.7
1.15.4
1.16.3
1.17.2
1.18.0
1.18.1
1.17.1
1.13.8
1.17.0
1.16.2
1.13.7
1.14.6
1.15.3
1.16.1
1.16.0
1.15.2
1.13.6
1.12.7
1.13.5
1.14.5
1.15.1
1.12.6
1.13.4
1.14.4
1.15.0
1.12.5
1.13.3
1.14.3
1.12.4
1.13.2
1.14.2
1.14.1
1.14.0
1.13.1
1.13.0
1.12.3
1.12.2
1.12.1
1.12.0
1.11.2
1.11.1
1.11.0
1.10.0
1.9.1
1.9.0
1.8.0
1.7.1
1.7.0
1.6.0
1.5.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
Vulnerabilities (140)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU135118 - Use of Incorrect Operator CVE-2026-48497 |
CWE-480 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135117 - Use of a Broken or Risky Cryptographic Algorithm CVE-2026-47775 |
CWE-327 | Medium | 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135116 - Use After Free CVE-2026-47207 |
CWE-416 | Low | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135115 - NULL Pointer Dereference CVE-2026-47221 |
CWE-476 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135114 - Improper input validation CVE-2026-47220 |
CWE-20 | Medium | 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135113 - Improper input validation CVE-2026-47692 |
CWE-20 | Low | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135112 - Resource exhaustion CVE-2026-48044 |
CWE-400 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135111 - Stack-based buffer overflow CVE-2026-48042 |
CWE-121 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135110 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') CVE-2026-48743 |
CWE-444 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135109 - NULL Pointer Dereference CVE-2026-47204 |
CWE-476 | Low | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135108 - Use After Free CVE-2026-47205 |
CWE-416 | Medium | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135107 - Use After Free CVE-2026-48090 |
CWE-416 | Medium | 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU135106 - Improper input validation CVE-2026-47778 |
CWE-20 | Low | 1.35.12, 1.36.8, 1.37.4, 1.38.2 | 24.06.2026 |
SB2026062440 |
||
| #VU133363 - Asymmetric Resource Consumption (Amplification) CVE-2026-47774 |
CWE-405 | High | 1.35.11, 1.36.7, 1.37.3, 1.38.1 | 04.06.2026 |
SB2026060494 SB20260825118 |
||
| #VU119718 - Use After Free |
CWE-416 | Medium | 1.33.13, 1.34.11, 1.35.7, 1.36.3 | 10.12.2025 |
SB2025121089 |
||
| #VU119112 - Improper Certificate Validation CVE-2025-66220 |
CWE-295 | Low | 1.33.13, 1.34.11, 1.35.7, 1.36.3 | 03.12.2025 |
SB2025120345 |
||
| #VU119111 - State Issues CVE-2025-64763 |
CWE-371 | Low | 1.33.13, 1.34.11, 1.35.7, 1.36.3 | 03.12.2025 |
SB2025120345 |
||
| #VU135103 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2019-9901 |
CWE-22 | High | 1.9.1 | 08.11.2019 |
SB2019110835 |
||
| #VU135104 - Improper input validation CVE-2019-9900 |
CWE-20 | High | 1.9.1 | 08.11.2019 |
SB2019110835 |
||
| #VU20201 - Resource exhaustion CVE-2019-9514 |
CWE-400 | Medium | 1.11.1 | 13.08.2019 |
SB2019081326 SB2019082004 SB2019082502 and 79 more |
Showing elements 41 - 60 out of 140