Product by Envoyproxy
Envoy Proxy Envoy
127 known vulnerabilities in Envoy Proxy Envoy (Envoyproxy), 2 of them actively exploited (CISA KEV).
Key figures
127
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
13
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder In CISA KEValso in 18 other products | 8.1 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEValso in 160 other products | 7.5 | |
| High | CVE-2024-27919 | HTTP/2: memory exhaustion due to CONTINUATION frame flood | 7.5 | |
| High | CVE-2021-29492 | Bypass of path matching rules using escaped slash characters | 8.1 | |
| High | CVE-2019-15226 | Envoy Proxy Envoy: Denial of Service | 7.5 | |
| High | CVE-2024-30255 | HTTP/2: CPU exhaustion due to CONTINUATION frame flood | 5.3 | |
| Critical | CVE-2019-18801 | Envoy Proxy Envoy: security vulnerability | 9.8 | |
| Critical | CVE-2019-18802 | Envoy Proxy Envoy: security vulnerability | 9.8 | |
| High | CVE-2021-32777 | Incorrect concatenation of multiple value request headers in ext-authz extension | 8.6 | |
| High | CVE-2019-15225 | Envoy Proxy Envoy: Denial of Service | 7.5 | |
| Critical | CVE-2019-9901 | Envoy Proxy Envoy: security vulnerability | 6.5 | |
| High | CVE-2019-9900 | Envoy Proxy Envoy: security vulnerability | 6.5 | |
| High | CVE-2020-35471 | Envoy Proxy Envoy: security vulnerability | 7.5 | |
| High | CVE-2026-73512 | Envoy: use-after-free in QUIC on internal redirects | 7.5 | |
| Critical | CVE-2022-29226 | Trivial authentication bypass in Envoy | 10.0 | |
| High | CVE-2019-18838 | Envoy Proxy Envoy: NULL Pointer Dereference | 7.5 | |
| High | CVE-2021-28682 | Envoy Proxy Envoy: Integer Overflow | 7.5 | |
| High | CVE-2021-39162 | Incorrect handling of H2 GOAWAY + SETTINGS frames | 8.6 | |
| High | CVE-2021-21378 | JWT authentication bypass with unknown issuer token | 8.2 | |
| High | CVE-2019-18836 | Envoy Proxy Envoy: Denial of Service | 7.5 | |
| High | CVE-2020-8659 | Envoy Proxy Envoy: security vulnerability | 7.5 | |
| High | CVE-2020-8661 | Envoy Proxy Envoy: security vulnerability | 7.5 | |
| High | CVE-2023-35945 | Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec | 7.5 | |
| High | CVE-2026-47774 | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification | 7.5 | |
| High | CVE-2021-29258 | Envoy Proxy Envoy: security vulnerability | 7.5 |
News
- 2nd November – Threat Intelligence Reportcheckpoint-research,
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026cisco-psirt,
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emergesthehackernews,
- Node2Shell (CVE-2026-111497) in active exploitationsophos-xops,
- Node2Shell puts Microsoft and Node.js on Brotli patch dutycsoonline,
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawthehackernews,