Product by Envoyproxy
Gateway
10 known vulnerabilities in Gateway (Envoyproxy), 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-53713 | Envoyproxy Gateway: Improper Input Validation | 9.1 | |
| Medium | CVE-2026-53716 | Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit | 6.5 | |
| Medium | CVE-2026-53719 | Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization | 6.5 | |
| Medium | CVE-2026-53717 | Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header | 6.5 | |
| High | CVE-2026-22771 | Envoy Extension Policy lua scripts injection causes arbitrary command execution | 8.8 | |
| High | CVE-2026-53714 | Envoyproxy Gateway: Missing Authentication for Critical Function | 7.4 | |
| Medium | CVE-2026-53718 | Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass | 6.4 | |
| Medium | CVE-2026-53715 | Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock | 5.3 | |
| High | CVE-2025-24030 | Envoy Admin Interface Exposed through prometheus metrics endpoint | 7.1 | |
| Medium | CVE-2025-25294 | Envoy Gateway Log Injection Vulnerability | 5.3 |