CVE-2021-28683: Envoyproxy Envoy

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.

Affected products

• Envoyproxy Envoy: version 1.16.2 only; version 1.17.1 only

Published 2021-05-20. Last modified 2026-06-17.