envoyproxy
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 129 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from April 9, 2019 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
Envoy: RBAC Authorization Bypass via Path Parameters
Envoy: Path normalization does not handle dot and dotdot segments with parameters
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
Envoy: use-after-free in QUIC on internal redirects
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
Envoy: oghttp2 upstream trailers incorrect handling
Monitor envoyproxy in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.