envoy
v1.40.2Cloud-native high-performance edge/middle/service proxy
- Maintenance
- Active1390 commits in 3 months · bus factor 11
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 30 advisories1 critical, 14 high, 15 medium · Scorecard 8.5/10
- Supported versions
- 4 lines supportednewest 1.40 · oldest 1.37 until Jan 13, 2027 · 8 ended
29.2k stars · 5.7k forks · 1.9k open issues · last release 19 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 1 critical, 14 high, 15 medium. Check the patched version against the one you run.
- criticalGHSA-3wvj-j6qm-62mrOct 23, 2026Out-of-Bounds Write in Brotli Decompressor
- Affected
- >= 1.18.0, <1.40.0
- Patched in
- 1.36.12 1.37.8 1.38.6 1.39.3
- highGHSA-8vc2-jrm4-835wOct 6, 2026Unauthenticated remote crash (null pointer dereference) in the OAuth2 HTTP filter via a path-less CONNECT request
- Affected
- >= 1.16.0, <1.40.0
- Patched in
- 1.36.12 1.37.8 1.38.6 1.39.3
- mediumGHSA-47vj-9r25-wv5jOct 6, 2026Crash in api_key_auth HTTP filter when hiding credentials on requests without a :path header (CONNECT)
- Affected
- >= 1.33.0
- Patched in
- 1.36.12 1.37.8 1.38.6 1.39.3
- highCVE-2026-73513Aug 26, 2026oghttp2 upstream trailers incorrect handling
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highCVE-2026-73552Aug 26, 2026HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highCVE-2026-73512Aug 26, 2026use-after-free in QUIC on internal redirects
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highCVE-2026-73547Aug 26, 2026ext_authz: request `:path` pseudoheader dereferenced w/o null check
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- mediumCVE-2026-73549Aug 26, 2026Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- mediumCVE-2026-50572Aug 26, 2026ext_authz - RawHttpClientImpl onSuccess 0x0 segfault
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highCVE-2026-73546Aug 26, 2026Stored XSS in Admin Stats Interface (/stats?format=html)
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- mediumCVE-2026-48521Aug 26, 2026HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- mediumCVE-2026-73551Aug 26, 2026Path normalization does not handle dot and dotdot segments with parameters
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- mediumCVE-2026-73511Aug 26, 2026Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highCVE-2026-73548Aug 26, 2026Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highCVE-2026-73550Aug 26, 2026HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highCVE-2026-73553Aug 26, 2026Path Parameter Canonicalization Bypasses Path-Based Security Rules
- Affected
- <1.40.0
- Patched in
- 1.39.1, 1.38.4, 1.37.6, 1.36.10
- highGHSA-p7c7-7c47-pwchJun 23, 2026Denial-of-Service Attack Against the HTTP/3 Stack via QPACK Blocked Decoding
- Affected
- <1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-48706Jun 23, 2026Envoy Heap Buffer Overflow in TcpStatsdSink
- Affected
- >=v1.34,<1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- highCVE-2026-48743Jun 23, 2026HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length
- Affected
- >=1.35,<1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-48497Jun 23, 2026Abnormal process termination in DNS UDP filter
- Affected
- <1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-48090Jun 23, 2026HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)
- Affected
- >=1.37,<1.39
- Patched in
- 1.37.5 1.38.3
- highCVE-2026-48042Jun 23, 2026Stack overflow in destructor of highly nested JSON
- Affected
- >=1.18,<1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-47778Jun 23, 2026Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
- Affected
- <= 1.38
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-47692Jun 23, 2026PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
- Affected
- >= v1.34, <1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-47204Jun 23, 2026Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes
- Affected
- >=1.26,<=1.38.0
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- highCVE-2026-48044Jun 23, 2026Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
- Affected
- >=1.23,<1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-47775Jun 23, 2026OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption
- Affected
- >=1.35,<1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- highCVE-2026-47220Jun 23, 2026Segmentation fault when using %REQUESTED_SERVER_NAME% in log format
- Affected
- >=v1.37.0,<1.39
- Patched in
- 1.37.5 1.38.3
- mediumCVE-2026-47221Jun 23, 2026Null pointer deref in internal redirects
- Affected
- >=1.18,<1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3
- mediumCVE-2026-47207Jun 23, 2026Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message
- Affected
- >= v1.34, <1.39
- Patched in
- 1.35.13 1.36.9 1.37.5 1.38.3