CVE-2022-21656

Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted.

• CWE-295
• CWE-843

• https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64ePatch, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2Issue Tracking, Third Party Advisory
• https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64ePatch, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2Issue Tracking, Third Party Advisory

Published

Feb 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21650Convos is an open source multi-user chat that runs in a web …5.4
• CVE-2022-21651Shopware is an open source e-commerce software platform. An …6.1
• CVE-2022-21652Shopware is an open source e-commerce software platform. In …8.1
• CVE-2022-21653Jawn is an open source JSON parser. Extenders of the `org.ty…7.5
• CVE-2022-21654Envoy is an open source edge and service proxy, designed for…9.8
• CVE-2022-21655Envoy is an open source edge and service proxy, designed for…7.5
• CVE-2022-21657Envoy is an open source edge and service proxy, designed for…6.5
• CVE-2022-21658Rust is a multi-paradigm, general-purpose programming langua…6.3
• CVE-2022-21659Flask-AppBuilder is an application development framework, bu…5.3
• CVE-2022-2166Improper Restriction of Excessive Authentication Attempts in…9.8
• CVE-2022-21660Gin-vue-admin is a backstage management system based on vue …8.1
• CVE-2022-21661WordPress is a free and open-source content management syste…7.5