CVE-2025-66220
📋 TL;DR
Envoy's mTLS certificate matcher incorrectly validates certificates with embedded null bytes in OTHERNAME SAN values, potentially allowing unauthorized access. This affects Envoy proxy deployments using mTLS with match_typed_subject_alt_names configuration. Organizations using affected Envoy versions for service-to-service communication are at risk.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass mTLS authentication and gain unauthorized access to internal services, potentially leading to data exfiltration or lateral movement.
Likely Case
Unauthorized clients could establish connections to services they shouldn't have access to, violating security boundaries.
If Mitigated
With proper network segmentation and additional authentication layers, impact would be limited to specific services.
🎯 Exploit Status
Exploitation requires ability to craft certificates with embedded null bytes and access to mTLS-enabled endpoints
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.33.13, 1.34.11, 1.35.7, 1.36.3
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p
Restart Required: Yes
Instructions:
1. Update Envoy to patched version. 2. Restart Envoy service. 3. Verify configuration remains valid.
🔧 Temporary Workarounds
Disable match_typed_subject_alt_names
allRemove or disable match_typed_subject_alt_names configuration if not required
# Edit Envoy configuration to remove match_typed_subject_alt_names
🧯 If You Can't Patch
- Implement network segmentation to limit blast radius
- Add additional authentication layers beyond mTLS
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and verify if match_typed_subject_alt_names is configured in mTLS settingsCheck Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is patched and test mTLS connections with certificates containing null bytes📡 Detection & Monitoring
Log Indicators:
- Unexpected mTLS connections from unauthorized certificates
- Certificate validation errors
Network Indicators:
- Unusual traffic patterns from mTLS endpoints
- Connections with malformed certificates
SIEM Query:
source="envoy" AND ("certificate" OR "mTLS") AND ("error" OR "invalid")