108
CVEs
11
Critical
65
High
1
KEV
39
PoC
33
Unpatched C/H
55.6%
Patch Rate
4.6%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
65
MEDIUM
30
LOW
2
Monthly CVE Trend
Affected Products (30)
Envoy
105
Kubernetes
3
Pomerium
3
Gateway
3
Istio
3
Nghttp2
2
Openshift Service Mesh
2
Openshift Api For Data Protection
1
Ceph Storage
1
3Scale Api Management Platform
1
Windows Server 2019
1
Armeria
1
Big Ip Application Security Manager
1
Process Automation
1
Debian Linux
1
Big Ip Link Controller
1
Go
1
Oncommand Insight
1
Integration Service Registry
1
Decision Manager
1
Openshift Container Platform
1
Big Ip Local Traffic Manager
1
Windows 11 22h2
1
Jboss Data Grid
1
Data Center Network Manager
1
Build Of Quarkus
1
Crosswork Situation Manager
1
Proxygen
1
Jetty
1
Support For Spring Boot
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2023-44487 | Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected. | HIGH | 7.5 | 94.4% | 202 |
KEV
PoC
|
| CVE-2019-18801 | An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 2.5% | 69 |
PoC
|
| CVE-2019-18802 | An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 2.5% | 69 |
PoC
|
| CVE-2023-27488 | Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2023-27487 | Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.1 | 0.6% | 66 |
PoC
No patch
|
| CVE-2023-27491 | Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.1 | 0.9% | 66 |
PoC
No patch
|
| CVE-2023-27493 | Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.1 | 0.5% | 66 |
PoC
No patch
|
| CVE-2026-22771 | Credential theft via Lua script execution in Envoy Gateway versions before 1.5.7 and 1.6.2 allows authenticated attackers to extract proxy credentials and subsequently access the control plane and all associated secrets including TLS private keys. Public exploit code exists for this vulnerability. Affected organizations running vulnerable Envoy Gateway instances should immediately upgrade as no patch is currently available for intermediate versions. | HIGH | 8.8 | 0.0% | 64 |
PoC
|
| CVE-2019-9900 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.3 | 3.7% | 62 |
PoC
No patch
|
| CVE-2020-25017 | Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.3 | 1.3% | 62 |
PoC
No patch
|
| CVE-2026-26308 | Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating each value individually, allowing attackers to bypass "Deny" access control policies through header manipulation. This vulnerability affects Envoy versions prior to 1.34.13, 1.35.8, 1.36.5, and 1.37.1, and public exploit code exists. Patches are available for all affected versions. | HIGH | 7.5 | 0.0% | 58 |
PoC
|
| CVE-2019-15225 | In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 3.4% | 58 |
PoC
No patch
|
| CVE-2019-18836 | Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 1.9% | 58 |
PoC
No patch
|
| CVE-2019-18838 | An issue was discovered in Envoy 1.12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.5 | 2.1% | 58 |
PoC
|
| CVE-2020-35471 | Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.5 | 2.4% | 58 |
PoC
|