Envoy Proxy CVE-2025-66220

Exploitation requires: (1) Envoy configured with require_client_certificate: true and a match_typed_subject_alt_names rule against an OTHERNAME OID using an exact matcher; (2) the attacker possessing a client certificate signed by a CA that Envoy trusts, whose OTHERNAME SAN is encoded as BMPSTRING or UNIVERSALSTRING and contains an embedded null byte crafting the form 'matchedvalue\0attackervalue'. Limiting factors: the exploit only affects deployments that rely on OTHERNAME SAN matching (not the common DNS/URI/email SAN matchers), and the attacker must first obtain a trusted CA to issue such a malformed certificate - a significant real-world barrier. No end-user interaction is needed. Affected versions are Envoy ≤ 1.33.12, 1.34.0-1.34.10, 1.35.0-1.35.6, and 1.36.0-1.36.2.

This is a genuine but precondition-gated weakness rather than a mass-exploitable flaw. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1) reflects network reachability and low complexity, but the description and GHSA advisory make clear the real gate: the attacker must possess a client certificate signed by a trusted CA that contains an embedded null byte inside an OTHERNAME SAN encoded as BMPSTRING/UNIVERSALSTRING. This is a meaningful barrier - the PR:L rating captures that the attacker already holds a (crafted) trusted cert, but obtaining CA issuance of such a malformed identity is non-trivial, arguably justifying higher attack complexity than AC:L. EPSS is 0.00% (0th percentile) and there is no CISA KEV listing, indicating no observed or predicted widespread exploitation. A detailed PoC is published in the vendor GHSA advisory, so publicly available exploit code exists, but POC availability is distinct from active exploitation. The CWE-170 (improper null termination) root cause is well understood and the impact (impersonation of a matched identity to bypass an exact OTHERNAME check) is real for environments that rely specifically on match_typed_subject_alt_names OTHERNAME matching. Net: treat as a MEDIUM real-world priority - patch on normal cadence, prioritized only where OTHERNAME SAN mTLS matching is used.

An attacker who can obtain a client certificate signed by a CA that Envoy trusts, crafted with an OTHERNAME SAN value like "victim\0evil" (BMPSTRING/UNIVERSALSTRING encoded), presents it to an Envoy instance configured with require_client_certificate and an exact match_typed_subject_alt_names rule of "victim". Envoy truncates the SAN at the null byte during UTF-8 conversion and accepts the certificate as the victim identity, granting unauthorized access to the protected service or API. A working PoC and reproduction steps are published in the vendor GHSA advisory.