Product by Go
Github.com/envoyproxy/envoy
9 known vulnerabilities in Github.com/envoyproxy/envoy (Go), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2019-9901 | Envoy Proxy Envoy: security vulnerability | 6.5 | |
| High | CVE-2025-54588 | Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults | 7.5 | |
| High | CVE-2026-26308 | Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation | 7.5 | |
| High | CVE-2026-26310 | Crash for scoped ip address in Envoy during DNS | 5.9 | |
| High | CVE-2025-30157 | Envoy crashes when HTTP ext_proc processes local replies | 6.5 | |
| Medium | CVE-2026-26311 | Envoy HTTP: filter chain execution on reset streams causing UAF crash | 5.9 | |
| Medium | CVE-2026-26309 | Envoy has an off-by-one write in JsonEscaper::escapeString() | 5.3 | |
| High | CVE-2026-26330 | Envoy Proxy Envoy: Use After Free | 5.3 | |
| Medium | CVE-2025-64763 | Envoy forwards early CONNECT data in TCP proxy mode | 3.7 |