Vulnerability Database

313,824

Total vulnerabilities in the database

CVE-2025-66220

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

  • Published: Dec 3, 2025
  • Updated: Dec 6, 2025
  • CVE: CVE-2025-66220
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

CWEs:

Software From Fixed in
envoyproxy / envoy - 1.33.13
envoyproxy / envoy 1.34.0 1.34.11
envoyproxy / envoy 1.35.0 1.35.7
envoyproxy / envoy 1.36.0 1.36.3