7.5
High
CVE-2022-29225 Envoy is a cloud-native high-performance proxy
Description
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| envoy 1.22 | earliest → < 1.22.1 | 1.22.1 |
Other CVEs of envoy
The 98 CVEs of envoy →
CVE-2026-73511
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Medium
CVE-2026-73553
Envoy is an open source edge and service proxy designed for cloud-native applications
7.5
High
CVE-2026-73551
Envoy is an open source edge and service proxy designed for cloud-native applications
5.3
Medium
CVE-2026-73546
Envoy is an open source edge and service proxy designed for cloud-native applications
7.4
High