CVE-2025-66220

Published: Dec 3, 2025Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

Affected (4)

Products: Envoyproxy: Envoy

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	Before 1.33.13
Envoyproxy Envoy	From 1.34.0 to 1.34.11
Envoyproxy Envoy	From 1.35.0 to 1.35.7
Envoyproxy Envoy	From 1.36.0 to 1.36.3

Related CWEs

Improper Null Termination

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

References (1)

https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.