# Envoy Proxy vulnerabilities Source: https://junglewise.ai/threats/vendors/envoy-proxy Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/envoy-proxy.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Envoy Proxy: 0 in the last 7 days and 2 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, Envoy Proxy denial-of-service in HTTP filter with prefix_rewrite, was published on 12 October 2026. 1 vulnerability in the last four weeks, level on the four before (1). 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 2 - All time: 20 (1 critical, 1 exploited in the wild) ## About Envoy Proxy An open source edge and service proxy designed for cloud-native applications. ## Latest Envoy Proxy vulnerabilities - [Envoy Proxy denial-of-service in HTTP filter with prefix_rewrite](https://junglewise.ai/threats/gcp-2026-067-0c826055) (info, published 12 Oct 2026) - [CVE-2026-73548: Envoy HTTP upgrade connection poisoning](https://junglewise.ai/threats/cve-2026-73548-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud) (high, CVSS 7.5, published 21 Sep 2026) - [CVE-2026-48090: Envoy use-after-free in HTTP OAuth2 filter](https://junglewise.ai/threats/cve-2026-48090-envoy-use-after-free-in-http-oauth2-filter) (medium, CVSS 5.9, published 26 Jun 2026) - [CVE-2026-47220: Envoy denial of service via NULL pointer dereference in log formatting](https://junglewise.ai/threats/cve-2026-47220-envoy-denial-of-service-via-null-pointer-dereference-in-log) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-47205: Envoy Use-After-Free in ext_authz filter during stream teardown](https://junglewise.ai/threats/cve-2026-47205-envoy-use-after-free-in-ext-authz-filter-during-stream-teardown) (medium, CVSS 5.9, published 26 Jun 2026) - [CVE-2026-48743: Envoy HTTP/3 to HTTP/1 request smuggling in downstream translation](https://junglewise.ai/threats/cve-2026-48743-envoy-http-3-to-http-1-request-smuggling-in-downstream) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-48706: Envoy heap buffer overflow in TcpStatsdSink](https://junglewise.ai/threats/cve-2026-48706-envoy-heap-buffer-overflow-in-tcpstatsdsink) (medium, CVSS 5.9, published 26 Jun 2026) - [CVE-2026-48497: Envoy denial of service in UDP DNS filter](https://junglewise.ai/threats/cve-2026-48497-envoy-denial-of-service-in-udp-dns-filter) (medium, CVSS 5.9, published 26 Jun 2026) - [CVE-2026-48044: Envoy Zstd decompressor memory exhaustion Denial of Service](https://junglewise.ai/threats/cve-2026-48044-envoy-zstd-decompressor-memory-exhaustion-denial-of-service) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-48042: Envoy stack overflow in JSON object destructor](https://junglewise.ai/threats/cve-2026-48042-envoy-stack-overflow-in-json-object-destructor) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-47778: Envoy improper certificate validation via NUL byte truncation in DNS SAN](https://junglewise.ai/threats/cve-2026-47778-envoy-improper-certificate-validation-via-nul-byte-truncation-in) (medium, CVSS 4.4, published 26 Jun 2026) - [CVE-2026-47775: Envoy OAuth2 HTTP filter padding oracle vulnerability](https://junglewise.ai/threats/cve-2026-47775-envoy-oauth2-http-filter-padding-oracle-vulnerability) (medium, CVSS 6.8, published 26 Jun 2026) - [CVE-2026-47692: Envoy PROXY Protocol v2 request smuggling via TLV length mismatch](https://junglewise.ai/threats/cve-2026-47692-envoy-proxy-protocol-v2-request-smuggling-via-tlv-length-mismatch) (high, CVSS 4.8, published 26 Jun 2026) - [CVE-2026-47221: Envoy null pointer dereference in router filter internal redirects](https://junglewise.ai/threats/cve-2026-47221-envoy-null-pointer-dereference-in-router-filter-internal) (medium, CVSS 5.9, published 26 Jun 2026) - [CVE-2026-47207: Envoy use-after-free in ext_proc filter gRPC message handling](https://junglewise.ai/threats/cve-2026-47207-envoy-use-after-free-in-ext-proc-filter-grpc-message-handling) (medium, CVSS 6.5, published 26 Jun 2026) - [CVE-2026-47204: Envoy Proxy null pointer dereference in grpc_stats filter](https://junglewise.ai/threats/cve-2026-47204-envoy-proxy-null-pointer-dereference-in-grpc-stats-filter) (medium, CVSS 6.5, published 26 Jun 2026) - [CVE-2026-47774: Envoy Proxy denial of service via HTTP/2 HPACK amplification](https://junglewise.ai/threats/cve-2026-47774-envoy-proxy-denial-of-service-via-http-2-hpack-amplification) (high, CVSS 7.5, published 17 Jun 2026) - [Envoy AI Gateway MCP message smuggling via parser differential](https://junglewise.ai/threats/envoy-ai-gateway-mcp-message-smuggling-via-parser-differential-a56e7319) (medium, CVSS 6.5, published 19 May 2026) - [CVE-2026-26308: Envoy RBAC header validation bypass via multi-value concatenation](https://junglewise.ai/threats/cve-2026-26308-envoy-rbac-header-validation-bypass-via-multi-value-concatenation) (high, CVSS 7.5, published 10 Mar 2026) - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) ## Most severe Envoy Proxy vulnerabilities - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) - [CVE-2026-47774: Envoy Proxy denial of service via HTTP/2 HPACK amplification](https://junglewise.ai/threats/cve-2026-47774-envoy-proxy-denial-of-service-via-http-2-hpack-amplification) (high, CVSS 7.5, published 17 Jun 2026) - [CVE-2026-73548: Envoy HTTP upgrade connection poisoning](https://junglewise.ai/threats/cve-2026-73548-envoy-is-an-open-source-edge-and-service-proxy-designed-for-cloud) (high, CVSS 7.5, published 21 Sep 2026) - [CVE-2026-26308: Envoy RBAC header validation bypass via multi-value concatenation](https://junglewise.ai/threats/cve-2026-26308-envoy-rbac-header-validation-bypass-via-multi-value-concatenation) (high, CVSS 7.5, published 10 Mar 2026) - [CVE-2026-47220: Envoy denial of service via NULL pointer dereference in log formatting](https://junglewise.ai/threats/cve-2026-47220-envoy-denial-of-service-via-null-pointer-dereference-in-log) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-48743: Envoy HTTP/3 to HTTP/1 request smuggling in downstream translation](https://junglewise.ai/threats/cve-2026-48743-envoy-http-3-to-http-1-request-smuggling-in-downstream) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-48044: Envoy Zstd decompressor memory exhaustion Denial of Service](https://junglewise.ai/threats/cve-2026-48044-envoy-zstd-decompressor-memory-exhaustion-denial-of-service) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-48042: Envoy stack overflow in JSON object destructor](https://junglewise.ai/threats/cve-2026-48042-envoy-stack-overflow-in-json-object-destructor) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-47692: Envoy PROXY Protocol v2 request smuggling via TLV length mismatch](https://junglewise.ai/threats/cve-2026-47692-envoy-proxy-protocol-v2-request-smuggling-via-tlv-length-mismatch) (high, CVSS 4.8, published 26 Jun 2026) - [CVE-2026-47775: Envoy OAuth2 HTTP filter padding oracle vulnerability](https://junglewise.ai/threats/cve-2026-47775-envoy-oauth2-http-filter-padding-oracle-vulnerability) (medium, CVSS 6.8, published 26 Jun 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Envoy Proxy technologies - [Envoy Proxy](https://junglewise.ai/threats/technologies/envoy): 19 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Envoy Proxy vulnerabilities", https://junglewise.ai/threats/vendors/envoy-proxy, 11 November 2026.