CVE-2025-66220
Envoyproxy Envoy ≤ 1.33.13
Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:NSummary
CVE-2025-66220 is a medium-severity Improper Null Termination (CWE-170) vulnerability in Envoyproxy Envoy. Its CVSS base score is 5.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201090
Vulnerability Data
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Null-byte SAN bypass in Envoy mTLS matcher directly enables exploitation of the public-facing proxy for unauthorized access.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of certificate SAN inputs to reject malformed values such as embedded null bytes before match_typed_subject_alt_names decisions.
Mandates proper authenticator (certificate) validation and management procedures that would catch invalid OTHERNAME SANs during mTLS verification.
Enforces access decisions only after correct authentication, preventing null-byte bypasses from granting unintended mTLS session access.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce correct string/array termination via coding standards, reviews, and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect missing or incorrect null terminators before release.
Secure SDLC mandates input validation and string handling rules that prevent missing null terminators.
Application security requirements can explicitly call for proper string termination and buffer handling.
Secure architecture principles include defensive coding practices that address buffer and string termination issues.
Secure coding standards directly require correct null termination of strings and arrays.