CVE-2025-66220Medium· 5.0▾ SunlitEnvoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null by…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
envoy < 1.33.13envoy >= 1.34.0, < 1.34.11envoy >= 1.35.0, < 1.35.7envoy >= 1.36.0, < 1.36.3Upgrade past the affected range:
envoy 1.36.3Connected by shared product, vendor, weakness, or advisory.
CVE-2023-35945High· 7.5Envoy is a cloud-native high-performance edge/middle/service proxy
CVE-2025-62504Medium· 6.5Envoy is an open source edge and service proxy
CVE-2025-62409High· 7.5Envoy is a cloud-native, open source edge and service proxy
CVE-2020-8661High· 7.5CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
CVE-2020-8664Medium· 5.3CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context
CVE-2020-8659High· 7.5CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e