Known vulnerabilities in envoy - page 3

Software: envoy
Software CPE: cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*
Total vulnerabilities: 140
Public exploits: 3
Known exploited (KEV): 1

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting envoy envoy is affected by 140 known vulnerabilities: 17 high, 103 medium, 20 low Critical High Medium Low

Vulnerabilities (140)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135118 - Use of Incorrect Operator
CVE-2026-48497
CWE-480 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135117 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2026-47775
CWE-327 Medium
No
No
1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135116 - Use After Free
CVE-2026-47207
CWE-416 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135115 - NULL Pointer Dereference
CVE-2026-47221
CWE-476 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135114 - Improper input validation
CVE-2026-47220
CWE-20 Medium
No
No
1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135113 - Improper input validation
CVE-2026-47692
CWE-20 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135112 - Resource exhaustion
CVE-2026-48044
CWE-400 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135111 - Stack-based buffer overflow
CVE-2026-48042
CWE-121 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135110 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-48743
CWE-444 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135109 - NULL Pointer Dereference
CVE-2026-47204
CWE-476 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135108 - Use After Free
CVE-2026-47205
CWE-416 Medium
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135107 - Use After Free
CVE-2026-48090
CWE-416 Medium
No
No
1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU135106 - Improper input validation
CVE-2026-47778
CWE-20 Low
No
No
1.35.12, 1.36.8, 1.37.4, 1.38.2 24.06.2026 SB2026062440
#VU133363 - Asymmetric Resource Consumption (Amplification)
CVE-2026-47774
CWE-405 High
No
No
1.35.11, 1.36.7, 1.37.3, 1.38.1 04.06.2026 SB2026060494
SB20260825118
#VU119718 - Use After Free
CWE-416 Medium
No
No
1.33.13, 1.34.11, 1.35.7, 1.36.3 10.12.2025 SB2025121089
#VU119112 - Improper Certificate Validation
CVE-2025-66220
CWE-295 Low
No
No
1.33.13, 1.34.11, 1.35.7, 1.36.3 03.12.2025 SB2025120345
#VU119111 - State Issues
CVE-2025-64763
CWE-371 Low
No
No
1.33.13, 1.34.11, 1.35.7, 1.36.3 03.12.2025 SB2025120345
#VU135103 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2019-9901
CWE-22 High
No
No
1.9.1 08.11.2019 SB2019110835
#VU135104 - Improper input validation
CVE-2019-9900
CWE-20 High
No
No
1.9.1 08.11.2019 SB2019110835
#VU20201 - Resource exhaustion
CVE-2019-9514
CWE-400 Medium
No
No
1.11.1 13.08.2019 SB2019081326
SB2019082004
SB2019082502
and 79 more


Showing elements 41 - 60 out of 140