CVE-2022-21657

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.

• CWE-295

• https://github.com/envoyproxy/envoy/pull/630Patch, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5gIssue Tracking, Third Party Advisory
• https://github.com/envoyproxy/envoy/pull/630Patch, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5gIssue Tracking, Third Party Advisory

Published

Feb 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21651Shopware is an open source e-commerce software platform. An …6.1
• CVE-2022-21652Shopware is an open source e-commerce software platform. In …8.1
• CVE-2022-21653Jawn is an open source JSON parser. Extenders of the `org.ty…7.5
• CVE-2022-21654Envoy is an open source edge and service proxy, designed for…9.8
• CVE-2022-21655Envoy is an open source edge and service proxy, designed for…7.5
• CVE-2022-21656Envoy is an open source edge and service proxy, designed for…5.9
• CVE-2022-21658Rust is a multi-paradigm, general-purpose programming langua…6.3
• CVE-2022-21659Flask-AppBuilder is an application development framework, bu…5.3
• CVE-2022-2166Improper Restriction of Excessive Authentication Attempts in…9.8
• CVE-2022-21660Gin-vue-admin is a backstage management system based on vue …8.1
• CVE-2022-21661WordPress is a free and open-source content management syste…7.5
• CVE-2022-21662WordPress is a free and open-source content management syste…5.4