CVE-2022-29227

score

<0.1

cvss

7.5

epss

1.2%

published

2022-06-09

kev added

—

first seen

2026-10-21

Envoy versions prior to 1.22.1 contain a use-after-free caused by a lifetime bug when handling internal redirects with large headers, letting attackers cause crashes or undefined behavior, exploit requires specific request conditions.