Input Validation and Logic

Every one of the 28 is a mark on the map. Named now: 1 to 26, most at risk first.

1. HTTP/2: CPU exhaustion due to CONTINUATION frame floodCVE-2024-30255envoyproxy · CVSS 5.3 · 85% likely

   CWE-390

2. HTTP/2: memory exhaustion due to CONTINUATION frame floodCVE-2024-27919envoyproxy · CVSS 7.5 · 84% likely

   CWE-390

3. Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin.…CVE-2019-9901Envoyproxy · CVSS 6.5 · 5.0% likely

   CWE-706

4. Incorrect handling of H/2 GOAWAY followed by SETTINGS framesCVE-2021-32780envoyproxy · CVSS 8.6 · 1.2% likely

   CWE-754

5. Incorrect handling of internal redirects results in crash in EnvoyCVE-2022-21655envoyproxy · CVSS 7.5 · 1.1% likely

   CWE-670

6. Envoy forwards invalid Http2/Http3 downstream headersCVE-2023-27491envoyproxy · CVSS 5.4 · 0.9% likely

   CWE-20

7. Envoy may crash when a redirect url without a state param is received in the oauth filterCVE-2023-27496envoyproxy · CVSS 6.5 · 0.8% likely

   CWE-20

8. Envoy crashes when using an address type that isn’t supported by the OSCVE-2024-23325envoyproxy · CVSS 7.5 · 0.8% likely

   CWE-248

9. Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.CVE-2023-27488envoyproxy · CVSS 5.4 · 0.7% likely

   CWE-20

10. Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemesCVE-2023-35944envoyproxy · CVSS 8.2 · 0.7% likely

    CWE-20

11. HTTP/1: sending overload crashes when the request is reset beforehand in envoyCVE-2024-53270envoyproxy · CVSS 7.5 · 0.7% likely

    CWE-670

12. Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoyCVE-2024-53269envoyproxy · CVSS 4.5 · 0.7% likely

    CWE-670

13. Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytesCVE-2024-32475envoyproxy · CVSS 7.5 · 0.7% likely

    CWE-253

14. Envoy can crash due to uncaught nlohmann JSON exceptionCVE-2024-34363envoyproxy · CVSS 7.5 · 0.7% likely

    CWE-248

15. Envoy client may fake the header `x-envoy-original-path`CVE-2023-27487envoyproxy · CVSS 8.2 · 0.6% likely

    CWE-20

16. Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clustersCVE-2026-73549envoyproxy · CVSS 5.3 · 0.6% likely

    CWE-754

17. HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoyCVE-2024-53271envoyproxy · CVSS 7.1 · 0.6% likely

    CWE-670

18. Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadataCVE-2024-23324envoyproxy · CVSS 8.6 · 0.6% likely

    CWE-20

19. Envoy: RBAC Authorization Bypass via Path ParametersCVE-2026-73553envoyproxy · CVSS 7.5 · 0.5% likely

    CWE-436

20. Envoy doesn't escape HTTP header valuesCVE-2023-27493envoyproxy · CVSS 8.1 · 0.5% likely

    CWE-20

21. oghttp2 crash on OnBeginHeadersForStream in envoyCVE-2024-45807envoyproxy · CVSS 7.5 · 0.5% likely

    CWE-670

22. Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header valuesCVE-2026-73552envoyproxy · CVSS 7.5 · 0.5% likely

    CWE-20

23. Crash for scoped ip address in Envoy during DNSCVE-2026-26310envoyproxy · CVSS 5.9 · 0.4% likely

    CWE-20

24. Envoy crashes when HTTP ext_proc processes local repliesCVE-2025-30157envoyproxy · CVSS 6.5 · 0.4% likely

    CWE-460

25. Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureCVE-2026-53713envoyproxy · CVSS 9.1 · 0.4% likely

    CWE-20

26. Envoy: Abnormal process termination in DNS UDP filterCVE-2026-48497envoyproxy · CVSS 5.9 · 0.4% likely

    CWE-480

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.