UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66220

TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

Severity
High 7.1
Published
3 Dec 2025
Last changed
25 Sept 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.33.13, 1.34.11, 1.35.7, 1.36.3
Also known as
GHSA-rwjg-c3h2-f57p
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.33.13
  • From 1.34.0 before 1.34.11
  • From 1.35.0 before 1.35.7
  • From 1.36.0 before 1.36.3
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.33.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66220
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66220
  • GitHub Advisory Database https://github.com/advisories/GHSA-rwjg-c3h2-f57p
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p