CVE-2025-66220
Fixed upstream EPSS <1%CVSS 5.0
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
Products: envoyproxy envoy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/envoyproxy/envoy | 1.36.3 |
| Go | github.com/envoyproxy/envoy | 1.35.7 |
| Go | github.com/envoyproxy/envoy | 1.34.11 |
| Go | github.com/envoyproxy/envoy | 1.33.13 |