E
Vendor security profile
envoyproxy
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs40
Critical1
CISA KEV0
Public exploit23
Patch rate%33
Avg. CVSS6.9
12-month vulnerability rate
0
2
1
0
0
0
0
12
0
0
20
0
CVE KEV
CVE severity distribution
40toplam CVE
Critical1 (3%)
High23 (57%)
Medium16 (40%)
Patch and exploitation view
%33
Verified patch
%0
CISA KEV
%57
Public exploit
13Patch available
0Partial
0Workaround
0Vendor: no patch
27Unknown
Latest vulnerabilities
5.3
CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
E
Patch verifiedEPSS %0
7.5
CVE-2026-73553
Envoy: RBAC Authorization Bypass via Path Parameters
E
Patch verifiedEPSS %1
5.3
CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot segments with parameters
E
Patch verifiedEPSS %1
7.4
CVE-2026-73546
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
E
Patch verifiedEPSS %1
7.5
CVE-2026-73512
Envoy: use-after-free in QUIC on internal redirects
E
Patch verifiedEPSS %1
7.5
CVE-2026-73550
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
E
Patch verifiedEPSS %1
7.5
CVE-2026-73547
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
E
Patch verifiedEPSS %1
5.9
CVE-2026-48521
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
E
Patch verifiedEPSS %1
5.3
CVE-2026-73549
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
E
Patch verifiedEPSS %1
7.5
CVE-2026-73513
Envoy: oghttp2 upstream trailers incorrect handling
E
Patch verifiedEPSS %0