CVE-2025-66220
BaseFortify
Publication date: 2025-12-03
Last updated on: 2025-12-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| envoyproxy | envoy | to 1.33.13 (exc) |
| envoyproxy | envoy | From 1.34.0 (inc) to 1.34.11 (exc) |
| envoyproxy | envoy | From 1.35.0 (inc) to 1.35.7 (exc) |
| envoyproxy | envoy | From 1.36.0 (inc) to 1.36.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-170 | The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Envoy affects its mTLS certificate matcher for match_typed_subject_alt_names. Specifically, certificates that contain an embedded null byte (\0) inside an OTHERNAME SAN value may be incorrectly treated as valid matches, potentially bypassing intended certificate validation checks.
How can this vulnerability impact me? :
The vulnerability can lead to improper validation of mTLS certificates, allowing potentially unauthorized certificates to be accepted as valid. This could result in unauthorized access or man-in-the-middle attacks, compromising confidentiality and integrity of communications.