# Envoyproxy Envoy


- [CVE-2026-111497](https://insights.sbomify.com/CVE-2026-111497/): Google Brotli Unchecked Return Value (critical 9.2, exploited in the wild)
- [CVE-2023-44487](https://insights.sbomify.com/CVE-2023-44487/): HTTP/2 Rapid Reset Attack (high 7.5, exploited in the wild)
- [CVE-2022-29226](https://insights.sbomify.com/CVE-2022-29226/): Trivial authentication bypass in Envoy (critical 10.0)
- [CVE-2019-18801](https://insights.sbomify.com/CVE-2019-18801/): Memory corruption in n/a (critical 9.8)
- [CVE-2019-18802](https://insights.sbomify.com/CVE-2019-18802/): Security feature bypass in n/a (critical 9.8)
- [CVE-2020-35470](https://insights.sbomify.com/CVE-2020-35470/): Information disclosure in n/a (high 8.8)
- [CVE-2024-23324](https://insights.sbomify.com/CVE-2024-23324/): Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata (high 8.6)
- [CVE-2023-35941](https://insights.sbomify.com/CVE-2023-35941/): Envoy vulnerable to OAuth2 credentials exploit with permanent validity (high 8.6)
- [CVE-2021-39162](https://insights.sbomify.com/CVE-2021-39162/): Incorrect handling of H2 GOAWAY + SETTINGS frames (high 8.6)
- [CVE-2021-39206](https://insights.sbomify.com/CVE-2021-39206/): Incorrect Authorization with specially crafted requests (high 8.6)
- [CVE-2021-32777](https://insights.sbomify.com/CVE-2021-32777/): Incorrect concatenation of multiple value request headers in ext-authz extension (high 8.6)
- [CVE-2021-32779](https://insights.sbomify.com/CVE-2021-32779/): Incorrectly handling of URI '#fragment' element as part of the path element (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/products/envoyproxy/envoy/