Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
envoyproxy envoy vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2021-32779
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorizati...
Envoyproxy Envoy 1.19.0
Envoyproxy Envoy
5
CVSSv2
CVE-2021-32781
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generat...
Envoyproxy Envoy 1.19.0
Envoyproxy Envoy
5
CVSSv2
CVE-2021-28683
An issue exists in Envoy up to and including 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
Envoyproxy Envoy 1.16.2
Envoyproxy Envoy 1.17.1
5
CVSSv2
CVE-2021-39162
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an up...
Envoyproxy Envoy
Envoyproxy Envoy 1.19.0
Pomerium Pomerium 0.15.0
5
CVSSv2
CVE-2021-39206
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, ...
Envoyproxy Envoy
Envoyproxy Envoy 1.19.0
Pomerium Pomerium
Pomerium Pomerium 0.15.0
5
CVSSv2
CVE-2021-39204
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition...
Envoyproxy Envoy
Envoyproxy Envoy 1.19.0
Pomerium Pomerium
Pomerium Pomerium 0.15.0
7.5
CVSSv2
CVE-2019-18802
An issue exists in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "ex...
Envoyproxy Envoy
5
CVSSv2
CVE-2022-29225
Envoy is a cloud-native high-performance proxy. In versions before 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an malicious user to zip bomb the decompressor by sending a small ...
Envoyproxy Envoy
6.4
CVSSv2
CVE-2022-29226
Envoy is a cloud-native high-performance proxy. In versions before 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the cu...
Envoyproxy Envoy
4.3
CVSSv2
CVE-2021-43824
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaro...
Envoyproxy Envoy
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
inject
CVE-2024-34001
CVE-2024-37018
LFI
CVE-2024-1275
CVE-2024-1086
CSRF
CVE-2024-31030
CVE-2024-24919
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »