Envoyproxy Envoy vulnerabilities
127 published vulnerabilities in Envoyproxy Envoy, 2 of them exploited in the wild. The most were published in 2026 (34), and 34 so far in 2026.
Envoyproxy Envoy vulnerabilities by year
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Envoyproxy Envoy vulnerabilities
- CVE-2026-111497 Google Brotli Unchecked Return Value
- CVE-2023-44487 HTTP/2 Rapid Reset Attack
- CVE-2022-29226 Trivial authentication bypass in Envoy
- CVE-2019-18801 Memory corruption in n/a
- CVE-2019-18802 Security feature bypass in n/a
- CVE-2020-35470 Information disclosure in n/a
- CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata
- CVE-2023-35941 Envoy vulnerable to OAuth2 credentials exploit with permanent validity
- CVE-2021-39162 Incorrect handling of H2 GOAWAY + SETTINGS frames
- CVE-2021-39206 Incorrect Authorization with specially crafted requests
- CVE-2021-32777 Incorrect concatenation of multiple value request headers in ext-authz extension
- CVE-2021-32779 Incorrectly handling of URI '#fragment' element as part of the path element
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.