CVE-2025-66220

Published: Dec 3, 2025Modified: Sep 25, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

Affected (4)

Products: Envoyproxy: Envoy

Envoyproxy

1 product

Envoy

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	version < 1.33.13
Envoyproxy Envoy	1.34.0 ≤ version < 1.34.11
Envoyproxy Envoy	1.35.0 ≤ version < 1.35.7
Envoyproxy Envoy	1.36.0 ≤ version < 1.36.3

Related CWEs

CWE-170

Improper Null Termination

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

References (1)

https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.