CVE-2025-66220

HighCVSS 7.1/10Last modified Sep 25, 2026

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-170

Affected software

Vendor	Product	Versions
envoyproxy	envoy	>= 1.36.0, <= 1.36.2; >= 1.35.0, <= 1.35.6; >= 1.34.0, <= 1.34.10; <= 1.33.12

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57pExploit, Vendor Advisory

Timeline

Published: Dec 3, 2025
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-662215.3Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Wi CVE-2025-662229.6DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability CVE-2025-662238.4OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, rem CVE-2025-662248.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralizati CVE-2025-662258.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce t CVE-2025-66234.3The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection CVE-2025-662367.5Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay atte CVE-2025-662376.7DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the data CVE-2025-662387.2DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual conso CVE-2025-66247.2Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug CVE-2025-662496.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy CVE-2025-66257.5CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the