CVE-2025-46821

07.05.2025, 22:15

Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not match a URI template expressions. This can result in bypass of RBAC rules when configured using the `uri_template` permissions. This vulnerability is fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, v1.31.8. As a workaround, configure additional RBAC permissions using `url_path` with `safe_regex` expression.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub_M	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Vendor	Product	Version
envoyproxy	envoy	𝑥 < 1.31.8
envoyproxy	envoy	1.32.0 ≤ 𝑥 < 1.32.6
envoyproxy	envoy	1.33.0 ≤ 𝑥 < 1.33.3
envoyproxy	envoy	1.34.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-186 - Overly Restrictive Regular Expression
A regular expression is overly restrictive, which prevents dangerous values from being detected.

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-c7cm-838g-6g67