{"schema_version":1,"title":"github.com/envoyproxy/envoy (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in github.com/envoyproxy/envoy (Go): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-26330, was published on 10 March 2026.","url":"https://junglewise.ai/threats/technologies/github-com-envoyproxy-envoy","json_url":"https://junglewise.ai/threats/technologies/github-com-envoyproxy-envoy.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/github-com-envoyproxy-envoy","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":1,"all_time":11,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":8},"latest":[{"cve":"CVE-2026-26330","cvss":3.1,"epss":0.0037,"slug":"cve-2026-26330-envoy-s-global-rate-limit-may-crash-when-the-response-phase-limit","title":"Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly","severity":"low","exploited":false,"published_at":"2026-03-10T18:31:57+00:00","url":"https://junglewise.ai/threats/cve-2026-26330-envoy-s-global-rate-limit-may-crash-when-the-response-phase-limit"},{"cve":"CVE-2026-26311","cvss":3.1,"epss":0.0048,"slug":"cve-2026-26311-envoy-http-filter-chain-execution-on-reset-streams-causing-uaf","title":"Envoy: HTTP - filter chain execution on reset streams causing UAF crash","severity":"low","exploited":false,"published_at":"2026-03-10T18:31:23+00:00","url":"https://junglewise.ai/threats/cve-2026-26311-envoy-http-filter-chain-execution-on-reset-streams-causing-uaf"},{"cve":"CVE-2026-26309","cvss":3.1,"epss":0.0042,"slug":"cve-2026-26309-envoy-affected-by-off-by-one-write-in-jsonescaper-escapestring","title":"Envoy affected by off-by-one write in JsonEscaper::escapeString()","severity":"low","exploited":false,"published_at":"2026-03-10T18:30:58+00:00","url":"https://junglewise.ai/threats/cve-2026-26309-envoy-affected-by-off-by-one-write-in-jsonescaper-escapestring"},{"cve":"CVE-2026-26308","cvss":7.5,"epss":0.0035,"slug":"cve-2026-26308-envoy-rbac-header-validation-bypass-via-multi-value-concatenation","title":"Envoy RBAC header validation bypass via multi-value concatenation","severity":"high","exploited":false,"published_at":"2026-03-10T18:30:42+00:00","url":"https://junglewise.ai/threats/cve-2026-26308-envoy-rbac-header-validation-bypass-via-multi-value-concatenation"},{"cve":"CVE-2026-26310","cvss":3.1,"epss":0.0046,"slug":"cve-2026-26310-envoy-vulnerable-to-crash-for-scoped-ip-address-during-dns","title":"Envoy vulnerable to crash for scoped ip address during DNS","severity":"low","exploited":false,"published_at":"2026-03-10T18:16:26+00:00","url":"https://junglewise.ai/threats/cve-2026-26310-envoy-vulnerable-to-crash-for-scoped-ip-address-during-dns"},{"cve":"CVE-2025-64763","cvss":3.1,"epss":0.003,"slug":"cve-2025-64763-envoy-forwards-early-connect-data-in-tcp-proxy-mode","title":"Envoy forwards early CONNECT data in TCP proxy mode","severity":"low","exploited":false,"published_at":"2025-12-05T18:12:51+00:00","url":"https://junglewise.ai/threats/cve-2025-64763-envoy-forwards-early-connect-data-in-tcp-proxy-mode"},{"cve":"CVE-2025-66220","cvss":5,"epss":0.0017,"slug":"cve-2025-66220-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12","title":"Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS…","severity":"medium","exploited":false,"published_at":"2025-12-03T19:15:58.01+00:00","url":"https://junglewise.ai/threats/cve-2025-66220-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12"},{"cve":"CVE-2025-64527","cvss":6.5,"epss":0.0053,"slug":"cve-2025-64527-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12","title":"Envoy crashes when JWT authentication is configured with the remote JWKS fetching","severity":"medium","exploited":false,"published_at":"2025-12-03T18:15:46.863+00:00","url":"https://junglewise.ai/threats/cve-2025-64527-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12"},{"cve":"CVE-2025-54588","cvss":3.1,"epss":0.0048,"slug":"cve-2025-54588-envoy-race-condition-in-dynamic-forward-proxy-leads-to-use-after","title":"Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults","severity":"low","exploited":false,"published_at":"2025-09-15T16:46:37+00:00","url":"https://junglewise.ai/threats/cve-2025-54588-envoy-race-condition-in-dynamic-forward-proxy-leads-to-use-after"},{"cve":"CVE-2025-30157","cvss":3.1,"epss":0.0043,"slug":"cve-2025-30157-envoy-crashes-when-http-ext-proc-processes-local-replies","title":"Envoy crashes when HTTP ext_proc processes local replies","severity":"low","exploited":false,"published_at":"2025-03-21T15:23:50+00:00","url":"https://junglewise.ai/threats/cve-2025-30157-envoy-crashes-when-http-ext-proc-processes-local-replies"},{"cve":"CVE-2019-9901","cvss":3,"epss":0.0495,"slug":"cve-2019-9901-envoyproxy-envoy-missing-http-url-path-normalization","title":"EnvoyProxy Envoy Missing HTTP URL path normalization","severity":"low","exploited":false,"published_at":"2022-05-24T16:44:38+00:00","url":"https://junglewise.ai/threats/cve-2019-9901-envoyproxy-envoy-missing-http-url-path-normalization"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/mattermost/mattermost-server (Go)","slug":"github-com-mattermost-mattermost-server","vulnerabilities":297,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server"},{"name":"github.com/mattermost/mattermost-server/v6 (Go)","slug":"github-com-mattermost-mattermost-server-v6","vulnerabilities":222,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6"},{"name":"github.com/mattermost/mattermost/server/v8 (Go)","slug":"github-com-mattermost-mattermost-server-v8","vulnerabilities":207,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8"},{"name":"github.com/mattermost/mattermost-server/v5 (Go)","slug":"github-com-mattermost-mattermost-server-v5","vulnerabilities":199,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5"},{"name":"stdlib (Go)","slug":"go-stdlib","vulnerabilities":178,"url":"https://junglewise.ai/threats/technologies/go-stdlib"},{"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vulnerabilities":160,"url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":126,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"code.vikunja.io/api (Go)","slug":"code-vikunja-io-api","vulnerabilities":91,"url":"https://junglewise.ai/threats/technologies/code-vikunja-io-api"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":81,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vulnerabilities":78,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},{"name":"github.com/traefik/traefik (Go)","slug":"github-com-traefik-traefik","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik"},{"name":"github.com/usememos/memos (Go)","slug":"github-com-usememos-memos","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-usememos-memos"}],"technology":{"hub":true,"name":"github.com/envoyproxy/envoy (Go)","slug":"github-com-envoyproxy-envoy","vendor":{"hub":true,"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"homepage":"https://www.envoyproxy.io/","repo_url":"https://github.com/envoyproxy/envoy","description":"Cloud-native proxy and communication bus designed for large service-oriented architectures.","url":"https://junglewise.ai/threats/technologies/github-com-envoyproxy-envoy"},"most_severe":[{"cve":"CVE-2026-26308","cvss":7.5,"epss":0.0035,"slug":"cve-2026-26308-envoy-rbac-header-validation-bypass-via-multi-value-concatenation","title":"Envoy RBAC header validation bypass via multi-value concatenation","severity":"high","exploited":false,"published_at":"2026-03-10T18:30:42+00:00","url":"https://junglewise.ai/threats/cve-2026-26308-envoy-rbac-header-validation-bypass-via-multi-value-concatenation"},{"cve":"CVE-2025-64527","cvss":6.5,"epss":0.0053,"slug":"cve-2025-64527-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12","title":"Envoy crashes when JWT authentication is configured with the remote JWKS fetching","severity":"medium","exploited":false,"published_at":"2025-12-03T18:15:46.863+00:00","url":"https://junglewise.ai/threats/cve-2025-64527-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12"},{"cve":"CVE-2025-66220","cvss":5,"epss":0.0017,"slug":"cve-2025-66220-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12","title":"Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS…","severity":"medium","exploited":false,"published_at":"2025-12-03T19:15:58.01+00:00","url":"https://junglewise.ai/threats/cve-2025-66220-envoy-is-a-high-performance-edge-middle-service-proxy-in-1-33-12"},{"cve":"CVE-2026-26311","cvss":3.1,"epss":0.0048,"slug":"cve-2026-26311-envoy-http-filter-chain-execution-on-reset-streams-causing-uaf","title":"Envoy: HTTP - filter chain execution on reset streams causing UAF crash","severity":"low","exploited":false,"published_at":"2026-03-10T18:31:23+00:00","url":"https://junglewise.ai/threats/cve-2026-26311-envoy-http-filter-chain-execution-on-reset-streams-causing-uaf"},{"cve":"CVE-2025-54588","cvss":3.1,"epss":0.0048,"slug":"cve-2025-54588-envoy-race-condition-in-dynamic-forward-proxy-leads-to-use-after","title":"Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults","severity":"low","exploited":false,"published_at":"2025-09-15T16:46:37+00:00","url":"https://junglewise.ai/threats/cve-2025-54588-envoy-race-condition-in-dynamic-forward-proxy-leads-to-use-after"},{"cve":"CVE-2026-26310","cvss":3.1,"epss":0.0046,"slug":"cve-2026-26310-envoy-vulnerable-to-crash-for-scoped-ip-address-during-dns","title":"Envoy vulnerable to crash for scoped ip address during DNS","severity":"low","exploited":false,"published_at":"2026-03-10T18:16:26+00:00","url":"https://junglewise.ai/threats/cve-2026-26310-envoy-vulnerable-to-crash-for-scoped-ip-address-during-dns"},{"cve":"CVE-2025-30157","cvss":3.1,"epss":0.0043,"slug":"cve-2025-30157-envoy-crashes-when-http-ext-proc-processes-local-replies","title":"Envoy crashes when HTTP ext_proc processes local replies","severity":"low","exploited":false,"published_at":"2025-03-21T15:23:50+00:00","url":"https://junglewise.ai/threats/cve-2025-30157-envoy-crashes-when-http-ext-proc-processes-local-replies"},{"cve":"CVE-2026-26309","cvss":3.1,"epss":0.0042,"slug":"cve-2026-26309-envoy-affected-by-off-by-one-write-in-jsonescaper-escapestring","title":"Envoy affected by off-by-one write in JsonEscaper::escapeString()","severity":"low","exploited":false,"published_at":"2026-03-10T18:30:58+00:00","url":"https://junglewise.ai/threats/cve-2026-26309-envoy-affected-by-off-by-one-write-in-jsonescaper-escapestring"},{"cve":"CVE-2026-26330","cvss":3.1,"epss":0.0037,"slug":"cve-2026-26330-envoy-s-global-rate-limit-may-crash-when-the-response-phase-limit","title":"Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly","severity":"low","exploited":false,"published_at":"2026-03-10T18:31:57+00:00","url":"https://junglewise.ai/threats/cve-2026-26330-envoy-s-global-rate-limit-may-crash-when-the-response-phase-limit"},{"cve":"CVE-2025-64763","cvss":3.1,"epss":0.003,"slug":"cve-2025-64763-envoy-forwards-early-connect-data-in-tcp-proxy-mode","title":"Envoy forwards early CONNECT data in TCP proxy mode","severity":"low","exploited":false,"published_at":"2025-12-05T18:12:51+00:00","url":"https://junglewise.ai/threats/cve-2025-64763-envoy-forwards-early-connect-data-in-tcp-proxy-mode"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}