E
Vendor security profile
envoyproxy
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs41
Critical1
CISA KEV0
Public exploit24
Patch rate%32
Avg. CVSS6.9
12-month vulnerability rate
0
2
1
0
0
0
0
12
0
0
20
0
CVE KEV
CVE severity distribution
41toplam CVE
Critical1 (2%)
High24 (59%)
Medium16 (39%)
Patch and exploitation view
%32
Verified patch
%0
CISA KEV
%59
Public exploit
13Patch available
0Partial
0Workaround
0Vendor: no patch
28Unknown
Latest vulnerabilities
5.3
CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
E
Patch verifiedEPSS %0
7.5
CVE-2026-73553
Envoy: RBAC Authorization Bypass via Path Parameters
E
Patch verifiedEPSS %1
5.3
CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot segments with parameters
E
Patch verifiedEPSS %1
7.4
CVE-2026-73546
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
E
Patch verifiedEPSS %1
7.5
CVE-2026-73512
Envoy: use-after-free in QUIC on internal redirects
E
Patch verifiedEPSS %1
7.5
CVE-2026-73550
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
E
Patch verifiedEPSS %1
7.5
CVE-2026-73547
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
E
Patch verifiedEPSS %1
5.9
CVE-2026-48521
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
E
Patch verifiedEPSS %1
5.3
CVE-2026-73549
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
E
Patch verifiedEPSS %1
7.5
CVE-2026-73513
Envoy: oghttp2 upstream trailers incorrect handling
E
Patch verifiedEPSS %0