CVE-2025-46821: envoy — Fix

Description

Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not match a URI template expressions. This can result in bypass of RBAC rules when configured using the `uri_template` permissions. This vulnerability is fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, v1.31.8. As a workaround, configure additional RBAC permissions using `url_path` with `safe_regex` expression.

Is your site exposed to CVE-2025-46821?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-186 CWE-186

Affected Products

Vendor	Product	Versions
envoyproxy	envoy	< 1.31.8
envoyproxy	envoy	1.32.0 — 1.32.6
envoyproxy	envoy	1.33.0 — 1.33.3
envoyproxy	envoy	All

References

Advisories & Patches

https://github.com/envoyproxy/envoy/security/advisories/GHSA-c7cm-838g-6g67

Frequently Asked Questions

What is CVE-2025-46821? +

Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not match a URI template expressions. This can result in bypass of RBAC rules when configured using the `uri_template` permissions. This vulnerability is fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, v1.31.8. As a workaround, configure additional RBAC permissions using `url_path` with `safe_regex` expression. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2025-46821? +

CVE-2025-46821 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-46821? +

CVE-2025-46821 affects products from envoyproxy, specifically: envoy. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-46821? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-23324 8.6

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC …

CVE-2024-23322 7.5

Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs …

CVE-2024-32976 7.5

Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless …

CVE-2024-45807 7.5

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are …

CVE-2024-34363 7.5

Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the …

CVE-2026-48044 7.5

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and …

CVE-2025-46821