Envoy Proxy
Envoy is a cloud-native L4/L7 proxy that powers the data plane in Istio, AWS App Mesh, and many Kubernetes ingress controllers. It terminates client traffic for API gateways and upstream services. NVD tracks it as envoyproxy:envoy with semver-style ranges on current release trains. Older builds used date-based version strings.
Querying Envoy Proxy
envoy1.35.13, 1.26.0, 1.25.8curl "https://api.attestd.io/v1/check?product=envoy&version=1.26.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Envoy 1.26.0 is affected by CVE-2023-35945 (HTTP/2 codec leaks header maps under CONTINUATION floods). The response shows risk_state: "high" because unauthenticated peers can exhaust worker memory.
{
"product": "envoy",
"version": "1.26.0",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "1.35.13",
"confidence": 0.5,
"cve_ids": [
"CVE-2023-35941",
"CVE-2023-35942",
"CVE-2023-35943",
"CVE-2023-35944",
"CVE-2023-35945",
"CVE-2024-23322",
"CVE-2024-23323",
"CVE-2024-23324",
"CVE-2024-23325",
"CVE-2024-23326",
"CVE-2024-23327",
"CVE-2024-30255",
"CVE-2024-32475",
"CVE-2024-32974",
"CVE-2024-32975",
"CVE-2024-32976",
"CVE-2024-34362",
"CVE-2024-34364",
"CVE-2024-45806",
"CVE-2024-45808",
"CVE-2024-45810",
"CVE-2024-53270",
"CVE-2025-30157",
"CVE-2025-46821",
"CVE-2025-55162",
"CVE-2025-62409",
"CVE-2025-62504",
"CVE-2025-64527",
"CVE-2025-64763",
"CVE-2025-66220",
"CVE-2026-26308",
"CVE-2026-26309",
"CVE-2026-26310",
"CVE-2026-26311",
"CVE-2026-26330",
"CVE-2026-47204",
"CVE-2026-47221",
"CVE-2026-47774",
"CVE-2026-47778",
"CVE-2026-48042",
"CVE-2026-48044",
"CVE-2026-48497"
],
"cves": null,
"max_epss": 0.8781,
"last_updated": "2026-08-16T11:14:54.987653Z",
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null,
"source_published_at": null,
"observed_at": null,
"ingested_at": null,
"first_served_at": null,
"provenance": null
},
"supply_chain_monitored": true,
"typosquat": null
}Envoy 1.35.13 sits past the CVE-2023-35945 fix on the 1.26 train and includes later HTTP/2 and filter hardening from subsequent releases.
curl "https://api.attestd.io/v1/check?product=envoy&version=1.35.13" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Envoy CVE history clusters around HTTP/2 codec resource exhaustion, authentication and authorization filter mistakes, and TLS validation edge cases. Many Istio deployments inherit Envoy CVEs through bundled proxy versions. Use the Istio product slug for control-plane specific issues.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2023-27488 | OAuth and request-processing flaw escalates privileges to bypass intended authz. | <1.22.9 + 1.23 to 1.25 | 9.8 |
CVE-2022-21654 | TLS cert validation settings reuse accepts certificates that should fail validation. | ≥1.7.0 through 1.21.x | 9.8 |
CVE-2023-35945 | HTTP/2 codec leaks header maps under CONTINUATION floods and exhausts memory (DoS). | <1.26.3 (and earlier trains) | 7.5 |
CVE-2023-44487KEV | HTTP/2 Rapid Reset DoSes Envoy worker resources. | HTTP/2 | 7.5 |
KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.
Envoy Proxy CPE namespace
NVD publishes Envoy CVEs under the envoyproxy vendor string. Attestd maps the envoy slug to that CPE and matches release-train semver ranges.
cpe:2.3:a:envoyproxy:envoyEnvoy Proxy data planeIstio control-plane CVEs use a separate product slug. Query Envoy for proxy binary versions and Istio for istiod / control-plane versions.