CVE-2025-25294: medium-severity vulnerability in envoyproxy gateway
Envoy Gateway Log Injection Vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the "EnvoyProxy.spec.telemetry.accessLog" setting.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
envoyproxy · gatewayRelated CVEs — envoyproxy gateway
In the same product, most dangerous first.
CVE-2026-53716MEDIUMEnvoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitEPSS 0.7%CVE-2026-53719MEDIUMEnvoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationEPSS 0.7%CVE-2026-53717MEDIUMEnvoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerEPSS 0.7%CVE-2026-22771HIGHEnvoy Extension Policy lua scripts injection causes arbitrary command executionEPSS 0.6%CVE-2026-53715MEDIUMEnvoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockEPSS 0.5%CVE-2026-53713CRITICALEnvoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret DisclosureEPSS 0.4%