Known vulnerabilities in envoy - page 3
Software:
envoy
Software CPE:
cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Website:
https://www.cncf.io/
Total vulnerabilities:
138
Public exploits:
3
Known exploited (KEV):
1
Highest CVSSv4 Score:
9.4
Breakdown by Severity Chart
1.36.10
1.37.6
1.38.4
1.39.1
1.39.0
1.38.3
1.37.5
1.36.9
1.35.13
1.38.2
1.37.4
1.36.8
1.35.12
1.38.1
1.37.3
1.36.7
1.35.11
1.38.0
1.37.2
1.36.6
1.35.10
1.34.14
1.37.1
1.36.5
1.35.9
1.34.13
1.37.0
1.36.4
1.35.8
1.34.12
1.33.14
1.36.3
1.35.7
1.34.11
1.33.13
1.36.2
1.35.6
1.34.10
1.33.12
1.34.9
1.35.5
1.36.1
1.33.11
1.36.0
1.35.4
1.34.8
1.33.10
1.32.13
1.35.3
1.34.7
1.33.9
1.32.12
1.35.2
1.34.6
1.33.8
1.32.11
1.35.1
1.34.5
1.33.7
1.32.10
1.34.4
1.33.6
1.32.9
1.35.0
1.34.3
1.33.5
1.32.8
1.31.10
1.34.2
1.33.4
1.32.7
1.31.9
1.34.1
1.33.3
1.32.6
1.31.8
1.34.0
1.33.2
1.32.5
1.31.7
1.30.11
1.33.1
1.32.4
1.31.6
1.30.10
1.33.0
1.32.3
1.31.5
1.30.9
1.29.12
1.32.2
1.31.4
1.30.8
1.29.11
1.32.1
1.31.3
1.30.7
1.29.10
1.32.0
1.31.2
1.30.6
1.29.9
1.28.7
1.31.1
1.30.5
1.29.8
1.28.6
1.31.0
1.30.4
1.29.7
1.28.5
1.27.7
1.30.3
1.29.6
1.28.4
1.29.5
1.30.2
1.27.6
1.30.1
1.29.4
1.28.3
1.27.5
1.30.0
1.29.3
1.28.2
1.27.4
1.26.8
1.29.2
1.29.1
1.28.1
1.27.3
1.26.7
1.29.0
1.28.0
1.27.2
1.26.6
1.25.11
1.24.12
1.25.10
1.26.5
1.27.1
1.24.11
1.27.0
1.25.9
1.26.4
1.24.10
1.23.12
1.26.3
1.25.8
1.24.9
1.23.11
1.26.2
1.25.7
1.24.8
1.23.10
1.26.1
1.25.6
1.24.7
1.23.9
1.26.0
1.25.5
1.24.6
1.23.8
1.22.11
1.25.4
1.24.5
1.23.7
1.22.10
1.25.3
1.24.4
1.23.6
1.22.9
1.25.2
1.24.3
1.23.5
1.22.8
1.22.7
1.23.4
1.24.2
1.25.1
1.25.0
1.24.1
1.23.3
1.22.6
1.21.6
1.24.0
1.23.2
1.23.1
1.22.5
1.22.4
1.22.3
1.21.5
1.20.7
1.23.0
1.20.6
1.20.5
1.21.4
1.22.2
1.22.1
1.21.3
1.20.4
1.19.5
1.21.2
1.20.3
1.19.4
1.22.0
1.21.1
1.20.2
1.19.3
1.18.6
1.21.0
1.20.1
1.20.0
1.16.5
1.17.4
1.18.4
1.19.1
1.19.0
1.15.5
1.16.4
1.17.3
1.18.3
1.18.2
1.14.7
1.15.4
1.16.3
1.17.2
1.18.0
1.18.1
1.17.1
1.13.8
1.17.0
1.16.2
1.13.7
1.14.6
1.15.3
1.16.1
1.16.0
1.15.2
1.13.6
1.12.7
1.13.5
1.14.5
1.15.1
1.12.6
1.13.4
1.14.4
1.15.0
1.12.5
1.13.3
1.14.3
1.12.4
1.13.2
1.14.2
1.14.1
1.14.0
1.13.1
1.13.0
1.12.3
1.12.2
1.12.1
1.12.0
1.11.2
1.11.1
1.11.0
1.10.0
1.9.1
1.9.0
1.8.0
1.7.1
1.7.0
1.6.0
1.5.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
Vulnerabilities (138)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU117943 - Out-of-bounds read CVE-2024-25178 |
CWE-125 | Medium | 1.33.10, 1.34.8, 1.35.4 | 03.11.2025 |
SB2025110350 SB2025110351 SB2025110359 and 4 more |
||
| #VU117942 - Stack-based buffer overflow CVE-2024-25176 |
CWE-121 | High | 1.33.10, 1.34.8, 1.35.4 | 03.11.2025 |
SB2025110350 SB2025110351 SB2025110359 and 4 more |
||
| #VU117941 - NULL Pointer Dereference CVE-2024-25177 |
CWE-476 | Low | 1.33.10, 1.34.8, 1.35.4 | 03.11.2025 |
SB2025110350 SB2025110351 SB2025110365 and 3 more |
||
| #VU117423 - Use After Free CVE-2025-62504 |
CWE-416 | Medium | 1.33.12, 1.34.10, 1.35.6, 1.36.2 | 21.10.2025 |
SB2025102158 |
||
| #VU117306 - NULL Pointer Dereference CVE-2025-62409 |
CWE-476 | Medium | 1.33.10, 1.34.9, 1.35.5, 1.36.1 | 16.10.2025 |
SB2025101625 |
||
| #VU114763 - Insufficient Session Expiration CVE-2025-55162 |
CWE-613 | Low | 1.32.10, 1.33.7, 1.34.5, 1.35.1 | 03.09.2025 |
SB2025090341 SB2025090352 |
||
| #VU114762 - Use After Free CVE-2025-54588 |
CWE-416 | Medium | 1.34.5, 1.35.1 | 03.09.2025 |
SB2025090341 SB2025090352 |
||
| #VU112255 - Deserialization of Untrusted Data CVE-2025-27818 |
CWE-502 | Medium | 1.33.10, 1.34.8, 1.35.4 | 04.07.2025 |
SB20250704102 SB2025070708 SB2025080519 and 16 more |
||
| #VU112146 - Server-Side Request Forgery (SSRF) CVE-2025-27817 |
CWE-918 | High | 1.33.10, 1.34.8, 1.35.4 | 03.07.2025 |
SB2025070339 SB2025070340 SB2025070345 and 42 more |
||
| #VU105934 - Improper input validation CVE-2025-30157 |
CWE-20 | Medium | 1.30.10, 1.31.6, 1.32.4, 1.33.1 | 21.03.2025 |
SB2025032123 |
||
| #VU101889 - Improper input validation CVE-2024-11407 |
CWE-20 | Medium | 1.33.10, 1.34.8, 1.35.4 | 20.12.2024 |
SB2024122036 SB2024122046 SB2024122057 and 10 more |
||
| #VU101847 - NULL Pointer Dereference CVE-2024-53270 |
CWE-476 | Medium | 1.29.12, 1.30.9, 1.31.5, 1.32.3 | 19.12.2024 |
SB2024121911 SB2024121913 SB2025020519 |
||
| #VU101846 - Resource Management Errors CVE-2024-53271 |
CWE-399 | Medium | 1.31.5, 1.32.3 | 19.12.2024 |
SB2024121911 SB2024121913 |
||
| #VU101845 - Improper input validation CVE-2024-53269 |
CWE-20 | Low | 1.30.8, 1.31.4, 1.32.2 | 19.12.2024 |
SB2024121909 SB2024121913 |
||
| #VU97627 - Resource Management Errors CVE-2024-45807 |
CWE-399 | Medium | 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 |
||
| #VU97626 - Improper Output Neutralization for Logs CVE-2024-45808 |
CWE-117 | Medium | 1.28.7, 1.29.9, 1.30.6, 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 SB2024100826 |
||
| #VU97625 - Improper input validation CVE-2024-45806 |
CWE-20 | Medium | 1.28.7, 1.29.9, 1.30.6, 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 SB2024100825 and 1 more |
||
| #VU97624 - NULL Pointer Dereference CVE-2024-45809 |
CWE-476 | Medium | 1.29.9, 1.30.6, 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 |
||
| #VU97623 - Resource Management Errors CVE-2024-45810 |
CWE-399 | Medium | 1.28.7, 1.29.9, 1.30.6, 1.31.2 | 20.09.2024 |
SB2024092014 SB2024092023 SB2024100826 |
||
| #VU95131 - Out-of-bounds read CVE-2024-7264 |
CWE-125 | Medium | 1.28.6, 1.29.8, 1.30.5, 1.31.1 | 01.08.2024 |
SB2024080110 SB2024080117 SB20240805104 and 43 more |
Showing elements 41 - 60 out of 138