CVE-2019-18836: Envoyproxy Envoy

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continue_on_listener_filters_timeout is used."

Affected products

• Envoyproxy Envoy: version 1.12.0 only
• Istio Istio: from 1.3.0, up to and including 1.3.3

Published 2019-11-11. Last modified 2026-06-17.