envoy up to 1.33.12/1.34.10/1.35.6/1.36.2 match_typed_subject_alt_names OTHERNAME null termination

Summaryinfo

A vulnerability described as problematic has been identified in envoy up to 1.33.12/1.34.10/1.35.6/1.36.2. The impacted element is the function match_typed_subject_alt_names. Such manipulation of the argument OTHERNAME leads to null termination. This vulnerability is referenced as CVE-2025-66220. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in envoy up to 1.33.12/1.34.10/1.35.6/1.36.2 and classified as problematic. Affected by this issue is the function match_typed_subject_alt_names. The manipulation of the argument OTHERNAME with an unknown input leads to a null termination vulnerability. Using CWE to declare the problem leads to CWE-170. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-66220 since 11/25/2025. The exploitation is known to be difficult. The attack may be launched remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/06/2026).

The vulnerability scanner Nessus provides a plugin with the ID 281808 (Amazon Linux 2 : ecs-service-connect-agent, --advisory ALAS2ECS-2025-093 (ALASECS-2025-093)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (281808) and EUVD (EUVD-2025-201090). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• envoy

Version

• 1.33.0
• 1.33.1
• 1.33.2
• 1.33.3
• 1.33.4
• 1.33.5
• 1.33.6
• 1.33.7
• 1.33.8
• 1.33.9
• 1.33.10
• 1.33.11
• 1.33.12
• 1.34.0
• 1.34.1
• 1.34.2
• 1.34.3
• 1.34.4
• 1.34.5
• 1.34.6
• 1.34.7
• 1.34.8
• 1.34.9
• 1.34.10
• 1.35.0
• 1.35.1
• 1.35.2
• 1.35.3
• 1.35.4
• 1.35.5
• 1.35.6
• 1.36.0
• 1.36.1
• 1.36.2

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion