mTLS Certificate Matcher Vulnerability in Envoy Proxy by Envoy
CVE-2025-66220

5MEDIUM

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
3 December 2025

What is CVE-2025-66220?

The Envoy Proxy has a vulnerability in its mTLS certificate matcher that may allow certificates containing an embedded null byte in an OTHERNAME Subject Alternative Name (SAN) value to be incorrectly recognized as valid. This flaw impacts multiple versions, potentially compromising secure communication. It is essential for users to verify their configurations and updates to mitigate potential risks associated with this vulnerability.

Affected Version(s)

envoy >= 1.36.0, <= 1.36.2 <= 1.36.0, 1.36.2

envoy >= 1.35.0, <= 1.35.6 <= 1.35.0, 1.35.6

envoy >= 1.34.0, <= 1.34.10 <= 1.34.0, 1.34.10

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.