BaseFortify

Publication date: 2025-12-03

Last updated on: 2025-12-05

Assigner: GitHub, Inc.

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-03

Last Modified

2025-12-05

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66220

EUVD

EUVD-2025-201090

Affected Vendors & Products

Vendor	Product	Version / Range
envoyproxy	envoy	to 1.33.13 (exc)
envoyproxy	envoy	From 1.34.0 (inc) to 1.34.11 (exc)
envoyproxy	envoy	From 1.35.0 (inc) to 1.35.7 (exc)
envoyproxy	envoy	From 1.36.0 (inc) to 1.36.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-170	The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Attack-Flow Graph

Executive Summary

This vulnerability in Envoy affects its mTLS certificate matcher for match_typed_subject_alt_names. Specifically, certificates that contain an embedded null byte (\0) inside an OTHERNAME SAN value may be incorrectly treated as valid matches, potentially bypassing intended certificate validation checks.

Impact Analysis

The vulnerability can lead to improper validation of mTLS certificates, allowing potentially unauthorized certificates to be accepted as valid. This could result in unauthorized access or man-in-the-middle attacks, compromising confidentiality and integrity of communications.

Hi! I’m here to help you understand CVE-2025-66220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70